Create a workspace, or answer the live one created from this config.
Creating is idempotent for one config: an id already held by a
workspace created from an identical config answers that workspace
with 200, so a client that names its workspace can run again and
reach it; an id held by anything else is refused with 409. The
server’s policies judge the config as written (pre_workspace)
before any of it is built: a refusal is 403 with its reason, and
explain answers what they say without creating anything.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Mirage","description":"Mirage gives AI agents one virtual filesystem for S3, Google Drive, Slack, GitHub, Notion, Postgres, and SSH, so shell commands work across services.","colors":{"primary":"#0C0C0C","light":"#FAFAFA","dark":"#000000"},"logo":{"light":"https://mintcdn.com/struktoai/7G-pGKhPIqaKqOXr/logo/light.svg?fit=max\u0026auto=format\u0026n=7G-pGKhPIqaKqOXr\u0026q=85\u0026s=d7007be7b5588a72b2072d2c33791785","dark":"https://mintcdn.com/struktoai/7G-pGKhPIqaKqOXr/logo/dark.svg?fit=max\u0026auto=format\u0026n=7G-pGKhPIqaKqOXr\u0026q=85\u0026s=0a255f925beb7370a41145f3f9185e9d"},"favicon":"https://mintcdn.com/struktoai/F9Lv_nTaj6By6crk/favicon.svg?fit=max\u0026auto=format\u0026n=F9Lv_nTaj6By6crk\u0026q=85\u0026s=bbca6fb54e64d72bdda46fb667828f1f","api":{"playground":{"display":"none"}},"navbar":{"links":[{"icon":"globe","href":"https://www.strukto.ai/mirage","label":"mirage"},{"icon":"discord","href":"https://discord.gg/u8BPQ65KsS","label":""},{"icon":"x-twitter","href":"https://x.com/struktoai","label":""},{"icon":"github","href":"https://github.com/strukto-ai/mirage","label":"strukto-ai/mirage"}]},"footer":{"socials":{"github":"https://github.com/strukto-ai/mirage"}},"seo":{"metatags":{"keywords":"Mirage, filesystem for AI agents, virtual filesystem, AI agent tools, agent infrastructure, MCP alternative, bash for agents, S3 filesystem, Google Drive filesystem, Slack filesystem, GitHub filesystem, agent sandbox, Strukto","author":"Strukto","robots":"index, follow","googlebot":"index, follow","canonical":"https://docs.mirage.strukto.ai","theme-color":"#0C0C0C","color-scheme":"light dark","language":"en","category":"Technology","target":"developers","apple-mobile-web-app-capable":"yes","apple-mobile-web-app-status-bar-style":"black-translucent","og:type":"website","og:url":"https://docs.mirage.strukto.ai","og:image":"https://raw.githubusercontent.com/strukto-ai/mirage/main/assets/mirage-og-light@2x.png","og:image:alt":"Mirage: a virtual terminal for AI agents","og:site_name":"Mirage","og:locale":"en_US","twitter:card":"summary_large_image","twitter:site":"@struktoai","twitter:creator":"@struktoai","twitter:image":"https://raw.githubusercontent.com/strukto-ai/mirage/main/assets/mirage-og-light@2x.png","twitter:image:alt":"Mirage · A Virtual Terminal for AI Agents | Strukto"}},"contextual":{"options":["copy","view","chatgpt","claude","perplexity","mcp","cursor","vscode"],"display":"header"},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"struktoai","hasAudioNarration":false,"actualSubdomain":"struktoai","customDomains":["docs.mirage.strukto.ai"],"gitSource":{"type":"github","owner":"strukto-ai","repo":"mirage","deployBranch":"main","contentDirectory":"docs","isPrivate":true,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6aecc113b20fc35bf671c161","collectionId":"c7fe3e69-889e-47b8-b169-a31692320da7","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6aecc113b20fc35bf671c161"},"entitlements":{},"buildId":"6aee565bda8ce456c16389fb","clientVersion":"0.0.4076","searchFilterCounts":[{"language":"default","tag":"VFS","count":198},{"language":"default","tag":"Home","count":134},{"language":"default","tag":"API","count":98},{"language":"default","tag":"Operations","count":96},{"language":"default","tag":"TS","count":95},{"language":"default","tag":"Python","count":91},{"language":"default","tag":"CLIs","count":79},{"language":"default","tag":"Object Storage","count":48},{"language":"default","tag":"Cloud \u0026 Productivity","count":35},{"language":"default","tag":"Data \u0026 AI","count":33}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"api/operations/workspaces/create-a-workspace","slug":"/api/operations/workspaces/create-a-workspace","pageMetadata":{"title":"Create a workspace","description":"Create a workspace, or answer the live one created from this config.\n\nCreating is idempotent for one config: an id already held by a\nworkspace created from an identical config answers that workspace\nwith 200, so a client that names its workspace can run again and\nreach it; an id held by anything else is refused with 409. The\nserver's policies judge the config as written (`pre_workspace`)\nbefore any of it is built: a refusal is 403 with its reason, and\n`explain` answers what they say without creating anything.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces","href":"/api/operations/workspaces/create-a-workspace","autogeneratedByOpenApi":true},"description":{"compiledSource":"\"use strict\";\nconst {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n code: \"code\",\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsxs(_Fragment, {\n children: [_jsx(_components.p, {\n children: \"Create a workspace, or answer the live one created from this config.\"\n }), \"\\n\", _jsxs(_components.p, {\n children: [\"Creating is idempotent for one config: an id already held by a\\nworkspace created from an identical config answers that workspace\\nwith 200, so a client that names its workspace can run again and\\nreach it; an id held by anything else is refused with 409. The\\nserver’s policies judge the config as written (\", _jsx(_components.code, {\n children: \"pre_workspace\"\n }), \")\\nbefore any of it is built: a refusal is 403 with its reason, and\\n\", _jsx(_components.code, {\n children: \"explain\"\n }), \" answers what they say without creating anything.\"]\n })]\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Create a workspace","description":"Create a workspace, or answer the live one created from this config.\n\nCreating is idempotent for one config: an id already held by a\nworkspace created from an identical config answers that workspace\nwith 200, so a client that names its workspace can run again and\nreach it; an id held by anything else is refused with 409. The\nserver's policies judge the config as written (`pre_workspace`)\nbefore any of it is built: a refusal is 403 with its reason, and\n`explain` answers what they say without creating anything.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces","href":"/api/operations/workspaces/create-a-workspace","autogeneratedByOpenApi":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":[],"openApiReferenceData":{"operation":{"summary":"Create a workspace","operationId":"create_workspace_v1_workspaces_post","parameters":["d9a54047-336f-4230-840d-0d4a6767165d"],"requestBody":"3b92e6ea-51c8-4c0c-9158-e0ba708017ea","responses":{"200":"a01bbb98-942c-4479-84ea-25dcd4c4579d","201":"8e5d0eb3-3b25-4705-870a-1ae8e6da0daf","401":"ab6f961d-7457-42a4-ba6c-6e6a45852a56","403":"e55c3284-82b6-4fb6-a444-a3d812a7a43e","409":"da2eade3-3de2-4bfa-881d-db97a96a7300","422":"fbf7a76f-1c27-4e83-addf-e136d606979c","429":"5d0fda3e-7b46-48d4-9b8f-2d17a863f335","503":"a5f8b3e4-b98d-49df-8ec6-96a8241af96c"},"description":"Create a workspace, or answer the live one created from this config.\n\nCreating is idempotent for one config: an id already held by a\nworkspace created from an identical config answers that workspace\nwith 200, so a client that names its workspace can run again and\nreach it; an id held by anything else is refused with 409. The\nserver's policies judge the config as written (`pre_workspace`)\nbefore any of it is built: a refusal is 403 with its reason, and\n`explain` answers what they say without creating anything.","tags":["Workspaces"],"x-hosts":["daemon","hosted"],"method":"post","type":"path","servers":["5b646690-c8a6-470b-9b36-ade1de13789b"],"security":["4159ccc1-3afa-4800-8ae3-f86840818ec3"],"path":"/v1/workspaces","baseUrlOptions":["http://127.0.0.1:8765"],"title":"Create a workspace","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{"d9a54047-336f-4230-840d-0d4a6767165d":{"name":"explain","in":"query","description":"Return what the call would do without running it.","required":false,"schema":{"type":"boolean","default":false,"isRequired":false,"description":"Return what the call would do without running it.","uniqueKey":"","typeLabel":"boolean"}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"config":{"oneOf":[{"type":"object","title":"WorkspaceConfig","required":["mounts"],"properties":{"mounts":{"additionalProperties":{"properties":{"vfs":{"type":"string","title":"Vfs","isRequired":true,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.vfs","typeLabel":"string"},"mode":{"oneOf":[{"type":"string","title":"MountMode","description":"What a mount lets commands do, a cumulative ladder.\n\nREAD lists and reads. WRITE also creates, changes and deletes. EXEC\nalso lets the interpreter commands (python3, js) run code: a script\nfile named as their operand must sit on an EXEC mount, while inline\ncode and -m need one somewhere in the workspace (imports are not\nchecked by path). Shell scripts need no EXEC, since the shell checks\neach of their commands like a typed one; a ./script whose shebang\nnames python3 reaches python3, which does check.","enum":["read","write","exec"],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.mode.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","uniqueKey":"config.oneOf.0.mounts.additionalProperties.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.mode","typeLabel":"enum\u003cstring> | null"},"config":{"additionalProperties":true,"type":"object","title":"Config","uniqueKey":"config.oneOf.0.mounts.additionalProperties.config","typeLabel":"Config · object"},"command_limits":{"additionalProperties":{"properties":{"max_bytes":{"oneOf":[{"type":"integer","title":"Max Bytes","minimum":0,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.max_bytes.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max Bytes","uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.max_bytes.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.max_bytes","typeLabel":"integer | null"},"max_lines":{"oneOf":[{"type":"integer","title":"Max Lines","minimum":0,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.max_lines.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max Lines","uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.max_lines.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.max_lines","typeLabel":"integer | null"},"timeout_seconds":{"oneOf":[{"type":"number","title":"Timeout Seconds","minimum":0,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.timeout_seconds.oneOf.0","typeLabel":"number"},{"type":"null","title":"Timeout Seconds","uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.timeout_seconds.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.timeout_seconds","typeLabel":"number | null"},"walk_limit":{"oneOf":[{"type":"integer","title":"Walk Limit","minimum":-1,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.walk_limit.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Walk Limit","uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.walk_limit.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.walk_limit","typeLabel":"integer | null"},"on_exceed":{"type":"string","enum":["error","truncate"],"title":"OnExceed","default":"truncate","uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties.on_exceed","typeLabel":"enum\u003cstring>"}},"additionalProperties":false,"type":"object","title":"Limit","description":"A bound on a result: the policy layer's limit arm and the shape\nevery cap config parses into.\n\nCarries its fields inline (the Deny precedent: an action is its\npayload). ``kind`` is the wire discriminant; ``aggr`` is the\ncomposition law (AND to the tightest per bound, ANY on error mode)\nand ``layered`` the resolution law (each field from the most\nspecific layer that sets it). ``walk_limit`` caps the entries one\nwalk lists on a mount, -1 for no cap.","uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits.additionalProperties","typeLabel":"Limit · object"},"type":"object","title":"Command Limits","uniqueKey":"config.oneOf.0.mounts.additionalProperties.command_limits","typeLabel":"Command Limits · object"},"backend":{"type":"string","enum":["workspace","fuse","fskit","nfs"],"title":"MountBackend","description":"How a mount is exposed to the outside world.\n\nWORKSPACE is the default: the mount lives only inside mirage's own\nfilesystem and is reached through the command surface, with nothing\nregistered with the kernel. FUSE and FSKIT additionally expose it as a\nreal mountpoint.\n\nFSKIT is macOS 15.4+ only and needs no kernel extension. It has no\n``direct_io`` equivalent, so it serves correct reads only for mounts\nthat set ``sizes_always_known``; ``mirage.fuse.backend`` warns at mount\ntime about mounts whose size-unknown files will read as empty. Writes\nare also limited: appends and metadata ops persist, but the macFUSE\nFSKit shim flushes pages a file did not already have (a new file, or\ntruncate-then-write) as NUL bytes, a limit pinned in\n``integ/fuse/truth_fskit.json``.\nThere is deliberately no ``auto``: auto-selecting FSKIT would silently\ndegrade every API-backed mount.\n\nNFS mounts through the operating system's own NFS client, so nothing\nis installed: mirage serves NFSv3 on a local port and runs the system\n``mount``. Linux and macOS; Linux needs root to mount. It is read-only\nfor now, and like FSKIT it reads only as far as the size a file\nreports, so it serves mounts that set ``sizes_always_known``.","default":"workspace","uniqueKey":"config.oneOf.0.mounts.additionalProperties.backend","typeLabel":"enum\u003cstring>"},"mountpoint":{"oneOf":[{"type":"string","title":"Mountpoint","uniqueKey":"config.oneOf.0.mounts.additionalProperties.mountpoint.oneOf.0","typeLabel":"string"},{"type":"null","title":"Mountpoint","uniqueKey":"config.oneOf.0.mounts.additionalProperties.mountpoint.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.mountpoint","typeLabel":"string | null"},"read":{"oneOf":[{"type":"string","title":"ReadPolicy","description":"How a mount decides whether cached bytes may be served.\n\nFRESH revalidates against the backend's content token before serving\na cached copy; BOUNDED serves without revalidating, within the\nstaleness bound the mount declares.\n\nPINNED names the content a commit's fingerprint records. There is no\nversion layer to pin to, so a mount declaring it is refused at mount\ntime rather than quietly degraded to head: the vocabulary is\npublished, so someone will type it, and an informative refusal costs\none branch over a generic invalid-value error.","enum":["fresh","bounded","pinned"],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.read.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","uniqueKey":"config.oneOf.0.mounts.additionalProperties.read.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.read","typeLabel":"enum\u003cstring> | null"},"ttl":{"oneOf":[{"type":"integer","title":"Ttl","uniqueKey":"config.oneOf.0.mounts.additionalProperties.ttl.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Ttl","uniqueKey":"config.oneOf.0.mounts.additionalProperties.ttl.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.ttl","typeLabel":"integer | null"},"write":{"oneOf":[{"type":"string","title":"WritePolicy","description":"Whether a mount's writes carry the version they were based on.\n\nUNCONDITIONAL replacements use last-write-wins. Shared rewrites that\nobserved a missing file require atomic create-only under either policy.\nCONDITIONAL writes send the version the mount last saw for the path\n(the backend's native precondition, If-Match on the S3 family), so a\nwrite based on a stale read is refused instead of overwriting the newer\nbytes. STAGED names a staging layer mirage does not have; a mount declaring it is\nrefused at mount time, as ``read: pinned`` is.","enum":["unconditional","conditional","staged"],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.write.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","uniqueKey":"config.oneOf.0.mounts.additionalProperties.write.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.write","typeLabel":"enum\u003cstring> | null"},"index":{"oneOf":[{"type":"object","title":"RamIndexBlock","properties":{"type":{"type":"string","const":"ram","title":"Type","default":"ram","uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.0.type","typeLabel":"string"},"ttl":{"type":"number","title":"Ttl","default":600,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.0.ttl","typeLabel":"number"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.0","typeLabel":"RamIndexBlock · object"},{"type":"object","title":"RedisIndexBlock","required":["type"],"properties":{"type":{"type":"string","const":"redis","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.1.type","typeLabel":"string"},"ttl":{"type":"number","title":"Ttl","default":600,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.1.ttl","typeLabel":"number"},"url":{"type":"string","title":"Url","default":"redis://localhost:6379/0","uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.1.url","typeLabel":"string"},"key_prefix":{"oneOf":[{"type":"string","title":"Key Prefix","uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.1.key_prefix.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key Prefix","uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.1.key_prefix.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.1.key_prefix","typeLabel":"string | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.1","typeLabel":"RedisIndexBlock · object"},{"type":"null","title":"Index","uniqueKey":"config.oneOf.0.mounts.additionalProperties.index.oneOf.2","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.mounts.additionalProperties.index","typeLabel":"RamIndexBlock · object | RedisIndexBlock · object | null"}},"additionalProperties":false,"type":"object","required":["vfs"],"title":"MountBlock","uniqueKey":"config.oneOf.0.mounts.additionalProperties","typeLabel":"MountBlock · object"},"type":"object","title":"Mounts","isRequired":true,"uniqueKey":"config.oneOf.0.mounts","typeLabel":"Mounts · object"},"io":{"properties":{"buffer_bytes":{"type":"integer","maximum":9007199254740991,"minimum":16384,"title":"Buffer Bytes","default":65536,"uniqueKey":"config.oneOf.0.io.buffer_bytes","typeLabel":"integer"}},"additionalProperties":false,"type":"object","title":"IOConfig","description":"Workspace limits for each in-flight byte queue.","uniqueKey":"config.oneOf.0.io","typeLabel":"IOConfig · object"},"command_limits":{"oneOf":[{"type":"object","title":"Command Limits","additionalProperties":{"properties":{"max_bytes":{"oneOf":[{"type":"integer","title":"Max Bytes","minimum":0,"uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.max_bytes.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max Bytes","uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.max_bytes.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.max_bytes","typeLabel":"integer | null"},"max_lines":{"oneOf":[{"type":"integer","title":"Max Lines","minimum":0,"uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.max_lines.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max Lines","uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.max_lines.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.max_lines","typeLabel":"integer | null"},"timeout_seconds":{"oneOf":[{"type":"number","title":"Timeout Seconds","minimum":0,"uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.timeout_seconds.oneOf.0","typeLabel":"number"},{"type":"null","title":"Timeout Seconds","uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.timeout_seconds.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.timeout_seconds","typeLabel":"number | null"},"walk_limit":{"oneOf":[{"type":"integer","title":"Walk Limit","minimum":-1,"uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.walk_limit.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Walk Limit","uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.walk_limit.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.walk_limit","typeLabel":"integer | null"},"on_exceed":{"type":"string","enum":["error","truncate"],"title":"OnExceed","default":"truncate","uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties.on_exceed","typeLabel":"enum\u003cstring>"}},"additionalProperties":false,"type":"object","title":"Limit","description":"A bound on a result: the policy layer's limit arm and the shape\nevery cap config parses into.\n\nCarries its fields inline (the Deny precedent: an action is its\npayload). ``kind`` is the wire discriminant; ``aggr`` is the\ncomposition law (AND to the tightest per bound, ANY on error mode)\nand ``layered`` the resolution law (each field from the most\nspecific layer that sets it). ``walk_limit`` caps the entries one\nwalk lists on a mount, -1 for no cap.","uniqueKey":"config.oneOf.0.command_limits.oneOf.0.additionalProperties","typeLabel":"Limit · object"},"uniqueKey":"config.oneOf.0.command_limits.oneOf.0","typeLabel":"Command Limits · object"},{"type":"null","title":"Command Limits","uniqueKey":"config.oneOf.0.command_limits.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.command_limits","typeLabel":"Command Limits · object | null"},"max_memory":{"oneOf":[{"type":"string","title":"Max Memory","uniqueKey":"config.oneOf.0.max_memory.oneOf.0","typeLabel":"string"},{"type":"integer","title":"Max Memory","uniqueKey":"config.oneOf.0.max_memory.oneOf.1","typeLabel":"integer"},{"type":"null","title":"Max Memory","uniqueKey":"config.oneOf.0.max_memory.oneOf.2","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.max_memory","typeLabel":"string | integer | null"},"max_body_bytes":{"oneOf":[{"type":"string","title":"Max Body Bytes","uniqueKey":"config.oneOf.0.max_body_bytes.oneOf.0","typeLabel":"string"},{"type":"integer","title":"Max Body Bytes","uniqueKey":"config.oneOf.0.max_body_bytes.oneOf.1","typeLabel":"integer"},{"type":"null","title":"Max Body Bytes","uniqueKey":"config.oneOf.0.max_body_bytes.oneOf.2","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.max_body_bytes","typeLabel":"string | integer | null"},"max_env":{"oneOf":[{"type":"string","title":"Max Env","uniqueKey":"config.oneOf.0.max_env.oneOf.0","typeLabel":"string"},{"type":"integer","title":"Max Env","uniqueKey":"config.oneOf.0.max_env.oneOf.1","typeLabel":"integer"},{"type":"null","title":"Max Env","uniqueKey":"config.oneOf.0.max_env.oneOf.2","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.max_env","typeLabel":"string | integer | null"},"network":{"oneOf":[{"type":"boolean","title":"Network","default":true,"uniqueKey":"config.oneOf.0.network.oneOf.0","typeLabel":"boolean"},{"type":"object","title":"Network","default":true,"additionalProperties":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"config.oneOf.0.network.oneOf.1.additionalProperties.oneOf.0.items.[INDEX]","typeLabel":"string"},"uniqueKey":"config.oneOf.0.network.oneOf.1.additionalProperties.oneOf.0","typeLabel":"string[]"},{"type":"object","additionalProperties":{"type":"string","uniqueKey":"config.oneOf.0.network.oneOf.1.additionalProperties.oneOf.1.additionalProperties","typeLabel":"string"},"uniqueKey":"config.oneOf.0.network.oneOf.1.additionalProperties.oneOf.1","typeLabel":"object"}],"uniqueKey":"config.oneOf.0.network.oneOf.1.additionalProperties","typeLabel":"string[] | object"},"uniqueKey":"config.oneOf.0.network.oneOf.1","typeLabel":"Network · object"}],"uniqueKey":"config.oneOf.0.network","typeLabel":"boolean | Network · object"},"system_time":{"oneOf":[{"type":"string","title":"System Time","uniqueKey":"config.oneOf.0.system_time.oneOf.0","typeLabel":"string"},{"type":"null","title":"System Time","uniqueKey":"config.oneOf.0.system_time.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.system_time","typeLabel":"string | null"},"clis":{"oneOf":[{"type":"object","title":"Clis","additionalProperties":{"properties":{"cli":{"oneOf":[{"type":"string","title":"Cli","uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.cli.oneOf.0","typeLabel":"string"},{"type":"null","title":"Cli","uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.cli.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.cli","typeLabel":"string | null"},"script":{"oneOf":[{"type":"string","title":"Script","uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.script.oneOf.0","typeLabel":"string"},{"type":"null","title":"Script","uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.script.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.script","typeLabel":"string | null"},"runtime":{"oneOf":[{"type":"string","title":"Runtime","uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.runtime.oneOf.0","typeLabel":"string"},{"type":"null","title":"Runtime","uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.runtime.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.runtime","typeLabel":"string | null"},"config":{"additionalProperties":true,"type":"object","title":"Config","uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties.config","typeLabel":"Config · object"}},"additionalProperties":false,"type":"object","title":"CLIBlock","description":"One ``clis:`` entry: install a named CLI with its own config.\n\nThe section key is the installed head word. Exactly one handler\nsource: ``cli`` names a registered spec tree; ``script`` references\na program file whose content is embedded at load (the docker\nbuild-context model). ``runtime`` optionally pins the world runtime\nentry that runs the script; unset picks the first entry speaking\nthe script's language. ``config`` validates through the spec's\n``config_model`` at install time (fail loud). A CLI never takes a\nmode and never shares a mount's credentials: a binary has no mode,\nthe credential does.","uniqueKey":"config.oneOf.0.clis.oneOf.0.additionalProperties","typeLabel":"CLIBlock · object"},"uniqueKey":"config.oneOf.0.clis.oneOf.0","typeLabel":"Clis · object"},{"type":"null","title":"Clis","uniqueKey":"config.oneOf.0.clis.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.clis","typeLabel":"Clis · object | null"},"runtimes":{"oneOf":[{"type":"array","items":{"oneOf":[{"type":"string","uniqueKey":"config.oneOf.0.runtimes.oneOf.0.items.[INDEX].oneOf.0","typeLabel":"string"},{"type":"object","additionalProperties":true,"uniqueKey":"config.oneOf.0.runtimes.oneOf.0.items.[INDEX].oneOf.1","typeLabel":"object"}],"uniqueKey":"config.oneOf.0.runtimes.oneOf.0.items.[INDEX]","typeLabel":"string | object"},"title":"Runtimes","uniqueKey":"config.oneOf.0.runtimes.oneOf.0","typeLabel":"(string | object)[]"},{"type":"null","title":"Runtimes","uniqueKey":"config.oneOf.0.runtimes.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.runtimes","typeLabel":"(string | object)[] | null"},"route_policy":{"oneOf":[{"type":"object","title":"ProfilePolicy","description":"One program of a profile's policy, as the document states it: the\nprogram, and the runtime that runs it.\n\nArgs:\n script (ScriptSource | str): the policy program. A ``str`` is\n the path form the config loader accepts and loads; code\n passes the loaded ``ScriptSource``, so a path still spelled\n as a string when the workspace reads it means the config\n layer never saw it, and is refused there.\n runtime (str | dict[str, Any]): the runtime the program runs on:\n a name, or ``{name, config}`` for one that needs settings,\n the shape a ``runtimes`` entry has. Monty when the program\n names none; without the ``monty`` extra installed, such a\n program fails closed with the extra's install hint.\n env (dict[str, str | SecretRef]): variables the program runs\n with beside ``MIRAGE_POLICY_CTX``, on any runtime: a literal,\n or a pointer read from its source when the program first\n runs. None of the session's reach it.","required":["script"],"properties":{"script":{"oneOf":[{"type":"object","title":"ScriptSource","description":"A program's source: a policy program or a script CLI.\n\nA yaml ``script:`` value references a ``.py`` or ``.js``/``.mjs``\nfile whose content is embedded here at load; code passes the text.\nIt runs as a program on the runtime its config names, never edited.\n\nArgs:\n source (str): the script program.\n language (Language): the script's language (\"python\" or \"js\"),\n stamped from the file extension at config load; the\n programmatic default is \"python\".\n module (bool): the source is an ES module (a ``.mjs`` file), so\n a js engine must run it in module mode or ``import`` and\n top-level ``await`` fail. Stamped from the extension at\n load beside ``language``, since the path is gone once the\n source is embedded.","required":["source"],"properties":{"source":{"type":"string","title":"Source","isRequired":true,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.script.oneOf.0.source","typeLabel":"string"},"language":{"type":"string","enum":["python","js"],"title":"Language","default":"python","uniqueKey":"config.oneOf.0.route_policy.oneOf.0.script.oneOf.0.language","typeLabel":"enum\u003cstring>"},"module":{"type":"boolean","title":"Module","default":false,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.script.oneOf.0.module","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.script.oneOf.0","typeLabel":"ScriptSource · object"},{"type":"string","title":"Script","isRequired":true,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.script.oneOf.1","typeLabel":"string"}],"isRequired":true,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.script","typeLabel":"ScriptSource · object | string"},"runtime":{"oneOf":[{"type":"string","title":"Runtime","default":"monty","uniqueKey":"config.oneOf.0.route_policy.oneOf.0.runtime.oneOf.0","typeLabel":"string"},{"type":"object","title":"Runtime","default":"monty","additionalProperties":true,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.runtime.oneOf.1","typeLabel":"Runtime · object"}],"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.runtime","typeLabel":"string | Runtime · object"},"env":{"additionalProperties":{"oneOf":[{"type":"string","uniqueKey":"config.oneOf.0.route_policy.oneOf.0.env.additionalProperties.oneOf.0","typeLabel":"string"},{"type":"object","title":"SecretRef","description":"A configured value read from a source instead of written down.\n\nThe plane's one declarative pointer, spelled with the same three\nkeys the env plane's managed entry uses, so one grammar covers\nevery place a deployment points at a secret: a source's own config,\na mount's credential, a CLI's.\n\nWhere it may point is the *context's* rule, not this model's.\n`SecretSource` narrows its own config to `BOOTSTRAP_SOURCES`,\nbecause that is what stops the source table from needing a\ndependency graph; a mount has no such limit, since every source is\nalready built by the time one is read.\n\nArgs:\n provider (str): the bootstrap source, `env` or `dotenv`.\n Spelled `from:` in YAML (python keyword), via alias.\n ref (str): the source's address, a file path for `dotenv`.\n key (str): which of the secret's fields holds the value.","required":["from","key"],"properties":{"from":{"type":"string","title":"From","isRequired":true,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.env.additionalProperties.oneOf.1.from","typeLabel":"string"},"key":{"type":"string","title":"Key","isRequired":true,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.env.additionalProperties.oneOf.1.key","typeLabel":"string"},"ref":{"type":"string","title":"Ref","default":"","uniqueKey":"config.oneOf.0.route_policy.oneOf.0.env.additionalProperties.oneOf.1.ref","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.env.additionalProperties.oneOf.1","typeLabel":"SecretRef · object"}],"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.env.additionalProperties","typeLabel":"string | SecretRef · object"},"type":"object","title":"Env","default":{},"uniqueKey":"config.oneOf.0.route_policy.oneOf.0.env","typeLabel":"Env · object"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.route_policy.oneOf.0","typeLabel":"ProfilePolicy · object"},{"type":"null","uniqueKey":"config.oneOf.0.route_policy.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.route_policy","typeLabel":"ProfilePolicy · object | null"},"profiles":{"oneOf":[{"type":"object","title":"Profiles","additionalProperties":{"properties":{"cwd":{"oneOf":[{"type":"string","title":"Cwd","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.cwd.oneOf.0","typeLabel":"string"},{"type":"null","title":"Cwd","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.cwd.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.cwd","typeLabel":"string | null"},"env":{"oneOf":[{"type":"object","title":"Env","additionalProperties":{"oneOf":[{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.0","typeLabel":"string"},{"type":"object","title":"EnvVar","description":"One entry of the env map: a literal value or a managed pointer.\n\nThe env block is one map, name -> entry. A bare string in the map\nis the literal short form and never reaches this model; a dict is\nvalidated through it. `value` and `from` are mutually exclusive and\none is required: `export` belongs to a literal entry, `ref`/`key`/\n`fetch` to a managed one, and `readonly` to either.\n\nArgs:\n value (str | None): the literal text; set = a literal entry.\n readonly (bool): compiles to `VarAttr.READONLY`, so the agent\n cannot assign to the name or unset it. Legal on a managed\n entry too, and the point of one: the fetch writes the\n record itself rather than going through the shell's\n assignment gate, so mirage still fills a readonly\n credential while a line that tries to overwrite it is\n refused.\n export (bool): literal-only knob (default on); a managed entry\n is always exported.\n provider (str | None): registered source name; set = a managed\n entry. Spelled `from:` in YAML (python keyword), via alias.\n ref (str): the source's address for the secret.\n key (str | None): which secret field to read; default the\n variable's own name.\n fetch (Literal[\"lazy\", \"eager\"]): eager joins every line's\n fetch set instead of waiting for a reference.","properties":{"value":{"oneOf":[{"type":"string","title":"Value","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.value.oneOf.0","typeLabel":"string"},{"type":"null","title":"Value","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.value.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.value","typeLabel":"string | null"},"readonly":{"type":"boolean","title":"Readonly","default":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.readonly","typeLabel":"boolean"},"export":{"type":"boolean","title":"Export","default":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.export","typeLabel":"boolean"},"from":{"oneOf":[{"type":"string","title":"From","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.from.oneOf.0","typeLabel":"string"},{"type":"null","title":"From","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.from.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.from","typeLabel":"string | null"},"ref":{"type":"string","title":"Ref","default":"","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.ref","typeLabel":"string"},"key":{"oneOf":[{"type":"string","title":"Key","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.key.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.key.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.key","typeLabel":"string | null"},"fetch":{"type":"string","enum":["lazy","eager"],"title":"Fetch","default":"lazy","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1.fetch","typeLabel":"enum\u003cstring>"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties.oneOf.1","typeLabel":"EnvVar · object"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0.additionalProperties","typeLabel":"string | EnvVar · object"},"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.0","typeLabel":"Env · object"},{"type":"null","title":"Env","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.env","typeLabel":"Env · object | null"},"mounts":{"oneOf":[{"type":"object","title":"Mounts","additionalProperties":{"properties":{"mode":{"oneOf":[{"type":"string","title":"MountMode","description":"What a mount lets commands do, a cumulative ladder.\n\nREAD lists and reads. WRITE also creates, changes and deletes. EXEC\nalso lets the interpreter commands (python3, js) run code: a script\nfile named as their operand must sit on an EXEC mount, while inline\ncode and -m need one somewhere in the workspace (imports are not\nchecked by path). Shell scripts need no EXEC, since the shell checks\neach of their commands like a typed one; a ./script whose shebang\nnames python3 reaches python3, which does check.","enum":["read","write","exec"],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.mode.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.mode","typeLabel":"enum\u003cstring> | null"},"commands":{"oneOf":[{"type":"object","title":"MountCommandsBlock","description":"``commands:`` of one mount section: ``ask`` and ``deny`` only.\n\nA mount rule applies to a line that works inside the mount (its cwd\nor one of its paths lies under the root); its ``paths`` are\nabsolute, like every other path in the document, and must name\nsomething under that root. There is no ``allow`` here: what a\nsession can see is a property of the session, and an operand cannot\nmake a command \"not found\".\n\nArgs:\n ask (tuple[CommandRule, ...]): what needs sign-off here.\n deny (tuple[CommandRule, ...]): what is refused here.","properties":{"ask":{"items":{"properties":{"reason":{"type":"string","title":"Reason","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].reason","typeLabel":"string"},"commands":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].commands.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Commands","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].commands","typeLabel":"string[]"},"paths":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].paths.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Paths","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].paths","typeLabel":"string[]"},"mount":{"type":"string","title":"Mount","default":"","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].mount","typeLabel":"string"}},"additionalProperties":false,"type":"object","required":["reason"],"title":"CommandRule","description":"One admission rule of the permissions document: refuse (or ask\nabout) matching commands, on matching paths when it names any.\n\nIt is the compiled element of ``commands.deny`` and ``commands.ask``\nwherever the profile writes one, and reaches the workspace only inside\nthat document; ``PermissionsPolicy`` is what evaluates it. The\ndocument writes a rule in one of three shapes, and each compiles to\nrules of this class: a list of command patterns (a whole-line rule\non each, no paths), a mapping of command pattern to its paths (one\ncommand to many paths, one rule per command, so a path is never\nstated beside a command it was not meant for), or paths alone (a\nrule on every command, at the dispatcher too). A command entry is a\ntoken-prefix pattern over the line as the entry point normalizes it (``rm``\nis every rm line, ``git push`` every ``git push ...``, a ``*`` token\nany one token). Path entries use the document's one grammar: an\nentry with ``*``, ``?`` or ``[`` is a pattern (repo fnmatch dialect,\n``*`` crossing ``/``, a slashless pattern matching any name\ncomponent), anything else is an exact path and its subtree. Every\nentry is absolute or a name pattern, holds a token (a blank one\nwould be the root), and inside a mount section must name something\nunder that mount root.\n\nArgs:\n reason (str): why the command is refused, carried on the\n result's refusal record.\n commands (tuple[str, ...]): command patterns the rule applies\n to; empty means every command. A path-scoped rule carries\n exactly one.\n paths (tuple[str, ...]): path entries; empty refuses the\n command regardless of its operands.\n mount (str): set by the compiler for a rule written under a\n ``mounts.\u003cprefix>`` section, the mount root it is scoped to:\n it applies only to a line whose cwd or paths lie under it.\n Empty for a rule written at the top level; never typed in\n the document.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX]","typeLabel":"CommandRule · object"},"type":"array","title":"Ask","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.ask","typeLabel":"CommandRule · object[]"},"deny":{"items":{"properties":{"reason":{"type":"string","title":"Reason","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].reason","typeLabel":"string"},"commands":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].commands.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Commands","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].commands","typeLabel":"string[]"},"paths":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].paths.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Paths","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].paths","typeLabel":"string[]"},"mount":{"type":"string","title":"Mount","default":"","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].mount","typeLabel":"string"}},"additionalProperties":false,"type":"object","required":["reason"],"title":"CommandRule","description":"One admission rule of the permissions document: refuse (or ask\nabout) matching commands, on matching paths when it names any.\n\nIt is the compiled element of ``commands.deny`` and ``commands.ask``\nwherever the profile writes one, and reaches the workspace only inside\nthat document; ``PermissionsPolicy`` is what evaluates it. The\ndocument writes a rule in one of three shapes, and each compiles to\nrules of this class: a list of command patterns (a whole-line rule\non each, no paths), a mapping of command pattern to its paths (one\ncommand to many paths, one rule per command, so a path is never\nstated beside a command it was not meant for), or paths alone (a\nrule on every command, at the dispatcher too). A command entry is a\ntoken-prefix pattern over the line as the entry point normalizes it (``rm``\nis every rm line, ``git push`` every ``git push ...``, a ``*`` token\nany one token). Path entries use the document's one grammar: an\nentry with ``*``, ``?`` or ``[`` is a pattern (repo fnmatch dialect,\n``*`` crossing ``/``, a slashless pattern matching any name\ncomponent), anything else is an exact path and its subtree. Every\nentry is absolute or a name pattern, holds a token (a blank one\nwould be the root), and inside a mount section must name something\nunder that mount root.\n\nArgs:\n reason (str): why the command is refused, carried on the\n result's refusal record.\n commands (tuple[str, ...]): command patterns the rule applies\n to; empty means every command. A path-scoped rule carries\n exactly one.\n paths (tuple[str, ...]): path entries; empty refuses the\n command regardless of its operands.\n mount (str): set by the compiler for a rule written under a\n ``mounts.\u003cprefix>`` section, the mount root it is scoped to:\n it applies only to a line whose cwd or paths lie under it.\n Empty for a rule written at the top level; never typed in\n the document.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX]","typeLabel":"CommandRule · object"},"type":"array","title":"Deny","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0.deny","typeLabel":"CommandRule · object[]"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.0","typeLabel":"MountCommandsBlock · object"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.commands","typeLabel":"MountCommandsBlock · object | null"},"paths":{"oneOf":[{"type":"object","title":"PathsBlock","description":"``paths:`` of a profile, or of one of its mount sections.\n\n``hide`` entries use the document's one grammar: an entry with\n``*``, ``?`` or ``[`` is a pattern, anything else an exact path\nand its subtree (``utils/hidden.classify_paths``); every entry\nholds a token and is absolute or a name pattern, wherever the block\nis written. A hide entry may also be a group\n``{patterns: [...], reason: ...}``: the patterns join the flat list\nlike any other entry and the reason lands in ``reasons``, the\noperator-only side table (:class:`HideReason`).\n\n``show`` is the other half of the path axis: a mapping of path to\nmode (``{\"/repo/docs\": r}``), or a plain list whose entries inherit\nthe mount's mode. Every entry is absolute, a subtree or an anchored\npattern, because a show anchors to a place and a name pattern names\nnone. An entry re-opens its subtree inside a hidden region when its\nanchor is deeper than the hide's, and states the mode in force\nbelow its anchor when it carries one; both on the one anchor-depth\nrule.\n\nArgs:\n hide (tuple[str, ...]): what the profile makes nonexistent.\n show (tuple[ShowEntry, ...]): the profile's show entries, in\n document order.\n reasons (tuple[HideReason, ...]): why grouped hide entries\n exist, for the operator's entry points only.","properties":{"hide":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.hide.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Hide","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.hide","typeLabel":"string[]"},"show":{"items":{"properties":{"path":{"type":"string","title":"Path","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX].path","typeLabel":"string"},"mode":{"oneOf":[{"type":"string","title":"MountMode","description":"What a mount lets commands do, a cumulative ladder.\n\nREAD lists and reads. WRITE also creates, changes and deletes. EXEC\nalso lets the interpreter commands (python3, js) run code: a script\nfile named as their operand must sit on an EXEC mount, while inline\ncode and -m need one somewhere in the workspace (imports are not\nchecked by path). Shell scripts need no EXEC, since the shell checks\neach of their commands like a typed one; a ./script whose shebang\nnames python3 reaches python3, which does check.","enum":["read","write","exec"],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX].mode.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX].mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX].mode","typeLabel":"enum\u003cstring> | null"}},"additionalProperties":false,"type":"object","required":["path"],"title":"ShowEntry","description":"One ``show`` entry of a profile's path axis, compiled.\n\nArgs:\n path (str): the entry as written: an exact subtree or an\n anchored pattern, always absolute. A slashless name pattern\n is refused at validation, because a show anchors to a place\n and a name pattern names none.\n mode (MountMode | None): the mode the entry states for its\n subtree; None for a list-form entry, which inherits the\n mount's.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX]","typeLabel":"ShowEntry · object"},"type":"array","title":"Show","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.show","typeLabel":"ShowEntry · object[]"},"reasons":{"items":{"properties":{"patterns":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.reasons.items.[INDEX].patterns.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Patterns","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.reasons.items.[INDEX].patterns","typeLabel":"string[]"},"reason":{"type":"string","title":"Reason","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.reasons.items.[INDEX].reason","typeLabel":"string"}},"additionalProperties":false,"type":"object","required":["patterns","reason"],"title":"HideReason","description":"Why one group of hide entries exists, for the operator only.\n\nThe document may state a hide as ``{patterns: [...], reason: ...}``;\nthe patterns compile into the flat hide spec like any other entry,\nand this side table keeps the reason beside them for the host's\nentry points (audit, read-back). It is never rendered to the agent: a hide\nanswers ENOENT, and a reason on a nonexistent path would confirm\nthe path exists.\n\nArgs:\n patterns (tuple[str, ...]): the group's entries, as compiled\n (a mount section's entries anchored to its root).\n reason (str): why the operator hid them.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.reasons.items.[INDEX]","typeLabel":"HideReason · object"},"type":"array","title":"Reasons","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0.reasons","typeLabel":"HideReason · object[]"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.0","typeLabel":"PathsBlock · object"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties.paths","typeLabel":"PathsBlock · object | null"}},"additionalProperties":false,"type":"object","title":"ProfileMount","description":"One mount's entry in a profile: what this profile may do there.\n\nEvery field is optional, and an omitted mount is not a refusal: the\nmount is reachable at the mode it declares in the workspace's\n``mounts:``, which a profile can only weaken (``weaker_mode``), never\nraise. A profile that must not touch a mount hides it, so the mount\nreads as nonexistent rather than as a permission error naming\nsomething the profile cannot see.\n\n``commands`` here carries ask and deny only: an allow list installs\na command for the whole session, and visibility is answered before\nany operand exists, so it cannot be per mount. Rules written here\napply to a line that works inside this mount, by cwd or by operand,\nwhich is what a path-scoped rule cannot express (``cd /repo \u0026\u0026 git\ncommit`` names no path).\n\nArgs:\n mode (MountMode | None): this profile's mode for the mount; None\n keeps the mount's own.\n commands (MountCommandsBlock | None): ask and deny rules for\n lines working inside it.\n paths (PathsBlock | None): hides under it.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0.additionalProperties","typeLabel":"ProfileMount · object"},"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.0","typeLabel":"Mounts · object"},{"type":"null","title":"Mounts","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.mounts","typeLabel":"Mounts · object | null"},"paths":{"oneOf":[{"type":"object","title":"PathsBlock","description":"``paths:`` of a profile, or of one of its mount sections.\n\n``hide`` entries use the document's one grammar: an entry with\n``*``, ``?`` or ``[`` is a pattern, anything else an exact path\nand its subtree (``utils/hidden.classify_paths``); every entry\nholds a token and is absolute or a name pattern, wherever the block\nis written. A hide entry may also be a group\n``{patterns: [...], reason: ...}``: the patterns join the flat list\nlike any other entry and the reason lands in ``reasons``, the\noperator-only side table (:class:`HideReason`).\n\n``show`` is the other half of the path axis: a mapping of path to\nmode (``{\"/repo/docs\": r}``), or a plain list whose entries inherit\nthe mount's mode. Every entry is absolute, a subtree or an anchored\npattern, because a show anchors to a place and a name pattern names\nnone. An entry re-opens its subtree inside a hidden region when its\nanchor is deeper than the hide's, and states the mode in force\nbelow its anchor when it carries one; both on the one anchor-depth\nrule.\n\nArgs:\n hide (tuple[str, ...]): what the profile makes nonexistent.\n show (tuple[ShowEntry, ...]): the profile's show entries, in\n document order.\n reasons (tuple[HideReason, ...]): why grouped hide entries\n exist, for the operator's entry points only.","properties":{"hide":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.hide.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Hide","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.hide","typeLabel":"string[]"},"show":{"items":{"properties":{"path":{"type":"string","title":"Path","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX].path","typeLabel":"string"},"mode":{"oneOf":[{"type":"string","title":"MountMode","description":"What a mount lets commands do, a cumulative ladder.\n\nREAD lists and reads. WRITE also creates, changes and deletes. EXEC\nalso lets the interpreter commands (python3, js) run code: a script\nfile named as their operand must sit on an EXEC mount, while inline\ncode and -m need one somewhere in the workspace (imports are not\nchecked by path). Shell scripts need no EXEC, since the shell checks\neach of their commands like a typed one; a ./script whose shebang\nnames python3 reaches python3, which does check.","enum":["read","write","exec"],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX].mode.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX].mode.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX].mode","typeLabel":"enum\u003cstring> | null"}},"additionalProperties":false,"type":"object","required":["path"],"title":"ShowEntry","description":"One ``show`` entry of a profile's path axis, compiled.\n\nArgs:\n path (str): the entry as written: an exact subtree or an\n anchored pattern, always absolute. A slashless name pattern\n is refused at validation, because a show anchors to a place\n and a name pattern names none.\n mode (MountMode | None): the mode the entry states for its\n subtree; None for a list-form entry, which inherits the\n mount's.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.show.items.[INDEX]","typeLabel":"ShowEntry · object"},"type":"array","title":"Show","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.show","typeLabel":"ShowEntry · object[]"},"reasons":{"items":{"properties":{"patterns":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.reasons.items.[INDEX].patterns.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Patterns","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.reasons.items.[INDEX].patterns","typeLabel":"string[]"},"reason":{"type":"string","title":"Reason","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.reasons.items.[INDEX].reason","typeLabel":"string"}},"additionalProperties":false,"type":"object","required":["patterns","reason"],"title":"HideReason","description":"Why one group of hide entries exists, for the operator only.\n\nThe document may state a hide as ``{patterns: [...], reason: ...}``;\nthe patterns compile into the flat hide spec like any other entry,\nand this side table keeps the reason beside them for the host's\nentry points (audit, read-back). It is never rendered to the agent: a hide\nanswers ENOENT, and a reason on a nonexistent path would confirm\nthe path exists.\n\nArgs:\n patterns (tuple[str, ...]): the group's entries, as compiled\n (a mount section's entries anchored to its root).\n reason (str): why the operator hid them.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.reasons.items.[INDEX]","typeLabel":"HideReason · object"},"type":"array","title":"Reasons","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0.reasons","typeLabel":"HideReason · object[]"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.0","typeLabel":"PathsBlock · object"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.paths","typeLabel":"PathsBlock · object | null"},"vars":{"oneOf":[{"type":"object","title":"VarsBlock","description":"``vars:`` of a profile.\n\nArgs:\n hide (tuple[str, ...]): variable names or globs over names the\n session reads as unset.","properties":{"hide":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.vars.oneOf.0.hide.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Hide","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.vars.oneOf.0.hide","typeLabel":"string[]"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.vars.oneOf.0","typeLabel":"VarsBlock · object"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.vars.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.vars","typeLabel":"VarsBlock · object | null"},"commands":{"oneOf":[{"type":"object","title":"CommandsBlock","description":"``commands:`` at the top level of a profile.\n\n``allow`` lists the command patterns the profile allows; a line no\npattern covers is refused, ``\u003ccmd>: Permission denied`` at 126, like\nany other rule's Deny. Shell builtins are subjects like everything\nelse: a list stating only ``cat`` refuses ``echo`` and ``cd``. The agent's\nown functions are the one exemption, safe because every line of a\nbody passes the gate itself. ``ask`` rules are admitted only with a\nhost approval; ``deny`` rules refuse with a reason. A bare string in\neither is one command pattern with the default reason.\n\nArgs:\n allow (tuple[str, ...] | None): the profile's allow patterns;\n None (unstated) allows everything.\n ask (tuple[CommandRule, ...]): what needs sign-off, in order.\n deny (tuple[CommandRule, ...]): the profile's refusals, in order.","properties":{"allow":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.allow.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Allow","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.allow.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Allow","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.allow.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.allow","typeLabel":"string[] | null"},"ask":{"items":{"properties":{"reason":{"type":"string","title":"Reason","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].reason","typeLabel":"string"},"commands":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].commands.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Commands","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].commands","typeLabel":"string[]"},"paths":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].paths.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Paths","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].paths","typeLabel":"string[]"},"mount":{"type":"string","title":"Mount","default":"","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX].mount","typeLabel":"string"}},"additionalProperties":false,"type":"object","required":["reason"],"title":"CommandRule","description":"One admission rule of the permissions document: refuse (or ask\nabout) matching commands, on matching paths when it names any.\n\nIt is the compiled element of ``commands.deny`` and ``commands.ask``\nwherever the profile writes one, and reaches the workspace only inside\nthat document; ``PermissionsPolicy`` is what evaluates it. The\ndocument writes a rule in one of three shapes, and each compiles to\nrules of this class: a list of command patterns (a whole-line rule\non each, no paths), a mapping of command pattern to its paths (one\ncommand to many paths, one rule per command, so a path is never\nstated beside a command it was not meant for), or paths alone (a\nrule on every command, at the dispatcher too). A command entry is a\ntoken-prefix pattern over the line as the entry point normalizes it (``rm``\nis every rm line, ``git push`` every ``git push ...``, a ``*`` token\nany one token). Path entries use the document's one grammar: an\nentry with ``*``, ``?`` or ``[`` is a pattern (repo fnmatch dialect,\n``*`` crossing ``/``, a slashless pattern matching any name\ncomponent), anything else is an exact path and its subtree. Every\nentry is absolute or a name pattern, holds a token (a blank one\nwould be the root), and inside a mount section must name something\nunder that mount root.\n\nArgs:\n reason (str): why the command is refused, carried on the\n result's refusal record.\n commands (tuple[str, ...]): command patterns the rule applies\n to; empty means every command. A path-scoped rule carries\n exactly one.\n paths (tuple[str, ...]): path entries; empty refuses the\n command regardless of its operands.\n mount (str): set by the compiler for a rule written under a\n ``mounts.\u003cprefix>`` section, the mount root it is scoped to:\n it applies only to a line whose cwd or paths lie under it.\n Empty for a rule written at the top level; never typed in\n the document.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.ask.items.[INDEX]","typeLabel":"CommandRule · object"},"type":"array","title":"Ask","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.ask","typeLabel":"CommandRule · object[]"},"deny":{"items":{"properties":{"reason":{"type":"string","title":"Reason","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].reason","typeLabel":"string"},"commands":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].commands.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Commands","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].commands","typeLabel":"string[]"},"paths":{"items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].paths.items.[INDEX]","typeLabel":"string"},"type":"array","title":"Paths","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].paths","typeLabel":"string[]"},"mount":{"type":"string","title":"Mount","default":"","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX].mount","typeLabel":"string"}},"additionalProperties":false,"type":"object","required":["reason"],"title":"CommandRule","description":"One admission rule of the permissions document: refuse (or ask\nabout) matching commands, on matching paths when it names any.\n\nIt is the compiled element of ``commands.deny`` and ``commands.ask``\nwherever the profile writes one, and reaches the workspace only inside\nthat document; ``PermissionsPolicy`` is what evaluates it. The\ndocument writes a rule in one of three shapes, and each compiles to\nrules of this class: a list of command patterns (a whole-line rule\non each, no paths), a mapping of command pattern to its paths (one\ncommand to many paths, one rule per command, so a path is never\nstated beside a command it was not meant for), or paths alone (a\nrule on every command, at the dispatcher too). A command entry is a\ntoken-prefix pattern over the line as the entry point normalizes it (``rm``\nis every rm line, ``git push`` every ``git push ...``, a ``*`` token\nany one token). Path entries use the document's one grammar: an\nentry with ``*``, ``?`` or ``[`` is a pattern (repo fnmatch dialect,\n``*`` crossing ``/``, a slashless pattern matching any name\ncomponent), anything else is an exact path and its subtree. Every\nentry is absolute or a name pattern, holds a token (a blank one\nwould be the root), and inside a mount section must name something\nunder that mount root.\n\nArgs:\n reason (str): why the command is refused, carried on the\n result's refusal record.\n commands (tuple[str, ...]): command patterns the rule applies\n to; empty means every command. A path-scoped rule carries\n exactly one.\n paths (tuple[str, ...]): path entries; empty refuses the\n command regardless of its operands.\n mount (str): set by the compiler for a rule written under a\n ``mounts.\u003cprefix>`` section, the mount root it is scoped to:\n it applies only to a line whose cwd or paths lie under it.\n Empty for a rule written at the top level; never typed in\n the document.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.deny.items.[INDEX]","typeLabel":"CommandRule · object"},"type":"array","title":"Deny","default":[],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0.deny","typeLabel":"CommandRule · object[]"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.0","typeLabel":"CommandsBlock · object"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.commands","typeLabel":"CommandsBlock · object | null"},"policy":{"oneOf":[{"type":"object","title":"Policy","additionalProperties":{"items":{"properties":{"script":{"oneOf":[{"type":"object","title":"ScriptSource","description":"A program's source: a policy program or a script CLI.\n\nA yaml ``script:`` value references a ``.py`` or ``.js``/``.mjs``\nfile whose content is embedded here at load; code passes the text.\nIt runs as a program on the runtime its config names, never edited.\n\nArgs:\n source (str): the script program.\n language (Language): the script's language (\"python\" or \"js\"),\n stamped from the file extension at config load; the\n programmatic default is \"python\".\n module (bool): the source is an ES module (a ``.mjs`` file), so\n a js engine must run it in module mode or ``import`` and\n top-level ``await`` fail. Stamped from the extension at\n load beside ``language``, since the path is gone once the\n source is embedded.","required":["source"],"properties":{"source":{"type":"string","title":"Source","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].script.oneOf.0.source","typeLabel":"string"},"language":{"type":"string","enum":["python","js"],"title":"Language","default":"python","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].script.oneOf.0.language","typeLabel":"enum\u003cstring>"},"module":{"type":"boolean","title":"Module","default":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].script.oneOf.0.module","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].script.oneOf.0","typeLabel":"ScriptSource · object"},{"type":"string","title":"Script","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].script.oneOf.1","typeLabel":"string"}],"isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].script","typeLabel":"ScriptSource · object | string"},"runtime":{"oneOf":[{"type":"string","title":"Runtime","default":"monty","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].runtime.oneOf.0","typeLabel":"string"},{"type":"object","title":"Runtime","default":"monty","additionalProperties":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].runtime.oneOf.1","typeLabel":"Runtime · object"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].runtime","typeLabel":"string | Runtime · object"},"env":{"additionalProperties":{"oneOf":[{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].env.additionalProperties.oneOf.0","typeLabel":"string"},{"type":"object","title":"SecretRef","description":"A configured value read from a source instead of written down.\n\nThe plane's one declarative pointer, spelled with the same three\nkeys the env plane's managed entry uses, so one grammar covers\nevery place a deployment points at a secret: a source's own config,\na mount's credential, a CLI's.\n\nWhere it may point is the *context's* rule, not this model's.\n`SecretSource` narrows its own config to `BOOTSTRAP_SOURCES`,\nbecause that is what stops the source table from needing a\ndependency graph; a mount has no such limit, since every source is\nalready built by the time one is read.\n\nArgs:\n provider (str): the bootstrap source, `env` or `dotenv`.\n Spelled `from:` in YAML (python keyword), via alias.\n ref (str): the source's address, a file path for `dotenv`.\n key (str): which of the secret's fields holds the value.","required":["from","key"],"properties":{"from":{"type":"string","title":"From","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].env.additionalProperties.oneOf.1.from","typeLabel":"string"},"key":{"type":"string","title":"Key","isRequired":true,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].env.additionalProperties.oneOf.1.key","typeLabel":"string"},"ref":{"type":"string","title":"Ref","default":"","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].env.additionalProperties.oneOf.1.ref","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].env.additionalProperties.oneOf.1","typeLabel":"SecretRef · object"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].env.additionalProperties","typeLabel":"string | SecretRef · object"},"type":"object","title":"Env","default":{},"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX].env","typeLabel":"Env · object"}},"additionalProperties":false,"type":"object","required":["script"],"title":"ProfilePolicy","description":"One program of a profile's policy, as the document states it: the\nprogram, and the runtime that runs it.\n\nArgs:\n script (ScriptSource | str): the policy program. A ``str`` is\n the path form the config loader accepts and loads; code\n passes the loaded ``ScriptSource``, so a path still spelled\n as a string when the workspace reads it means the config\n layer never saw it, and is refused there.\n runtime (str | dict[str, Any]): the runtime the program runs on:\n a name, or ``{name, config}`` for one that needs settings,\n the shape a ``runtimes`` entry has. Monty when the program\n names none; without the ``monty`` extra installed, such a\n program fails closed with the extra's install hint.\n env (dict[str, str | SecretRef]): variables the program runs\n with beside ``MIRAGE_POLICY_CTX``, on any runtime: a literal,\n or a pointer read from its source when the program first\n runs. None of the session's reach it.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties.items.[INDEX]","typeLabel":"ProfilePolicy · object"},"type":"array","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0.additionalProperties","typeLabel":"ProfilePolicy · object[]"},"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.0","typeLabel":"Policy · object"},{"type":"null","title":"Policy","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.policy","typeLabel":"Policy · object | null"},"command_limits":{"oneOf":[{"type":"object","title":"Command Limits","additionalProperties":{"properties":{"max_bytes":{"oneOf":[{"type":"integer","title":"Max Bytes","minimum":0,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.max_bytes.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max Bytes","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.max_bytes.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.max_bytes","typeLabel":"integer | null"},"max_lines":{"oneOf":[{"type":"integer","title":"Max Lines","minimum":0,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.max_lines.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max Lines","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.max_lines.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.max_lines","typeLabel":"integer | null"},"timeout_seconds":{"oneOf":[{"type":"number","title":"Timeout Seconds","minimum":0,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.timeout_seconds.oneOf.0","typeLabel":"number"},{"type":"null","title":"Timeout Seconds","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.timeout_seconds.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.timeout_seconds","typeLabel":"number | null"},"walk_limit":{"oneOf":[{"type":"integer","title":"Walk Limit","minimum":-1,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.walk_limit.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Walk Limit","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.walk_limit.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.walk_limit","typeLabel":"integer | null"},"on_exceed":{"type":"string","enum":["error","truncate"],"title":"OnExceed","default":"truncate","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties.on_exceed","typeLabel":"enum\u003cstring>"}},"additionalProperties":false,"type":"object","title":"Limit","description":"A bound on a result: the policy layer's limit arm and the shape\nevery cap config parses into.\n\nCarries its fields inline (the Deny precedent: an action is its\npayload). ``kind`` is the wire discriminant; ``aggr`` is the\ncomposition law (AND to the tightest per bound, ANY on error mode)\nand ``layered`` the resolution law (each field from the most\nspecific layer that sets it). ``walk_limit`` caps the entries one\nwalk lists on a mount, -1 for no cap.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0.additionalProperties","typeLabel":"Limit · object"},"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.0","typeLabel":"Command Limits · object"},{"type":"null","title":"Command Limits","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.command_limits","typeLabel":"Command Limits · object | null"},"processes":{"oneOf":[{"type":"object","title":"ProcessPermissions","description":"How far past its own session a profile reaches into processes.\n\nA session always sees and stops its own processes. ``list`` widens\nwhat ``ps`` and a handler's process view see; ``kill`` widens what\nthey may stop, and never past ``list``. ``max`` caps the live\nprocesses the session holds, its running line included, as\n``ulimit -u`` counts the shell. A bare scope sets both. The workspace\nstates one for every session and a profile's overrides it field by\nfield (``layered``).\n\nArgs:\n list (ProcessScope): whose processes the session sees.\n kill (ProcessScope): whose processes the session may stop.\n max (int | None): most live processes, ``MAX_PROCESSES`` unless\n stated, None for no cap.","properties":{"list":{"type":"string","enum":["session","workspace"],"title":"List","default":"session","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.processes.oneOf.0.list","typeLabel":"enum\u003cstring>"},"kill":{"type":"string","enum":["session","workspace"],"title":"Kill","default":"session","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.processes.oneOf.0.kill","typeLabel":"enum\u003cstring>"},"max":{"oneOf":[{"type":"integer","title":"Max","default":128,"minimum":1,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.processes.oneOf.0.max.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max","default":128,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.processes.oneOf.0.max.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.processes.oneOf.0.max","typeLabel":"integer | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.processes.oneOf.0","typeLabel":"ProcessPermissions · object"},{"type":"null","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.processes.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.processes","typeLabel":"ProcessPermissions · object | null"},"network":{"oneOf":[{"type":"boolean","title":"Network","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network.oneOf.0","typeLabel":"boolean"},{"type":"object","title":"Network","additionalProperties":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network.oneOf.1.additionalProperties.oneOf.0.items.[INDEX]","typeLabel":"string"},"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network.oneOf.1.additionalProperties.oneOf.0","typeLabel":"string[]"},{"type":"object","additionalProperties":{"type":"string","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network.oneOf.1.additionalProperties.oneOf.1.additionalProperties","typeLabel":"string"},"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network.oneOf.1.additionalProperties.oneOf.1","typeLabel":"object"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network.oneOf.1.additionalProperties","typeLabel":"string[] | object"},"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network.oneOf.1","typeLabel":"Network · object"},{"type":"null","title":"Network","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network.oneOf.2","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties.network","typeLabel":"boolean | Network · object | null"}},"additionalProperties":false,"type":"object","title":"SessionProfile","description":"One profile: the whole permission document a session runs under.\n\nA session is created from exactly one of these, and it is the only\nplace permissions are written. There is no workspace-wide block and\nno mount-owned block above it, so reading this object is reading\neverything the profile may do; what a profile does not say, it does not\nrestrict. Configuration, not enforcement: the resolver compiles it\nonto the session's narrowing fields and the entry points keep enforcing.\nDeliberately not named a View, which per the view convention is a\nhandle an agent holds on one entry point, while a profile is what the\nembedder uses to *define* one. Frozen so two agents with the same\nprofile share one object and neither can bend the other's view.\n\nTwo rules decide a line against it, and they are the whole law.\nA rule naming no path is read by verb (deny before ask before\nallow), wherever it is written. A rule carrying paths, and every\nhide, is read by anchor depth: the deeper entry wins, ties break by\nverb.\n\nA profile may also state a ``policy``: for each ``pre_`` method it\nanswers at (``pre_execute``, ``pre_command``, ``pre_vfs``,\n``pre_session``), a list of programs, each with the runtime it runs\non (``ProfilePolicy``, the shape a ``clis`` entry has). A program's\nfunction for the method takes its context and returns its answer:\nNone for no opinion, a deny, an ask, or at ``pre_execute`` a route.\nThey are asked in order and the first deny wins, so a policy expresses\nthe conditions a declarative rule cannot; like every policy, it can\nonly restrict, never grant past a deny. The document is optional\nbeside it: a profile stating only a policy hides nothing, and the\npolicy is its whole admission policy.\n\nArgs:\n cwd (str | None): the session's working directory at creation.\n env (dict[str, str | EnvVar] | None): the env entries seeded\n into the session at creation, in the workspace ``env``\n grammar: a bare string is an exported literal, and a\n ``from:`` entry a managed pointer, so a credential is\n named here and fetched, never written as its value.\n mounts (dict[str, ProfileMount] | None): per-mount settings,\n keyed by prefix: a mode, ask and deny rules for lines\n working inside the mount, and hides under it. A mount the\n mapping omits keeps its own mode and gains no rules.\n paths (PathsBlock | None): the profile's hides, absolute.\n vars (VarsBlock | None): the profile's hidden variables.\n commands (CommandsBlock | None): the profile's allow list and its\n ask / deny rules, absolute paths.\n policy (dict[ScriptMethod, list[ProfilePolicy]] | None): the\n profile's policy: each ``pre_`` method's programs, asked in\n order.\n network (bool | dict[str, list[str]] | None): where the\n session's lines may connect, the workspace's ``network``\n grammar, held besides the workspace's own; None leaves the\n workspace's alone.","uniqueKey":"config.oneOf.0.profiles.oneOf.0.additionalProperties","typeLabel":"SessionProfile · object"},"uniqueKey":"config.oneOf.0.profiles.oneOf.0","typeLabel":"Profiles · object"},{"type":"null","title":"Profiles","uniqueKey":"config.oneOf.0.profiles.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profiles","typeLabel":"Profiles · object | null"},"profile":{"oneOf":[{"type":"string","title":"Profile","uniqueKey":"config.oneOf.0.profile.oneOf.0","typeLabel":"string"},{"type":"null","title":"Profile","uniqueKey":"config.oneOf.0.profile.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.profile","typeLabel":"string | null"},"processes":{"oneOf":[{"type":"object","title":"ProcessPermissions","description":"How far past its own session a profile reaches into processes.\n\nA session always sees and stops its own processes. ``list`` widens\nwhat ``ps`` and a handler's process view see; ``kill`` widens what\nthey may stop, and never past ``list``. ``max`` caps the live\nprocesses the session holds, its running line included, as\n``ulimit -u`` counts the shell. A bare scope sets both. The workspace\nstates one for every session and a profile's overrides it field by\nfield (``layered``).\n\nArgs:\n list (ProcessScope): whose processes the session sees.\n kill (ProcessScope): whose processes the session may stop.\n max (int | None): most live processes, ``MAX_PROCESSES`` unless\n stated, None for no cap.","properties":{"list":{"type":"string","enum":["session","workspace"],"title":"List","default":"session","uniqueKey":"config.oneOf.0.processes.oneOf.0.list","typeLabel":"enum\u003cstring>"},"kill":{"type":"string","enum":["session","workspace"],"title":"Kill","default":"session","uniqueKey":"config.oneOf.0.processes.oneOf.0.kill","typeLabel":"enum\u003cstring>"},"max":{"oneOf":[{"type":"integer","title":"Max","default":128,"minimum":1,"uniqueKey":"config.oneOf.0.processes.oneOf.0.max.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max","default":128,"uniqueKey":"config.oneOf.0.processes.oneOf.0.max.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.processes.oneOf.0.max","typeLabel":"integer | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.processes.oneOf.0","typeLabel":"ProcessPermissions · object"},{"type":"null","uniqueKey":"config.oneOf.0.processes.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.processes","typeLabel":"ProcessPermissions · object | null"},"mode":{"type":"string","enum":["read","write","exec"],"title":"MountMode","description":"What a mount lets commands do, a cumulative ladder.\n\nREAD lists and reads. WRITE also creates, changes and deletes. EXEC\nalso lets the interpreter commands (python3, js) run code: a script\nfile named as their operand must sit on an EXEC mount, while inline\ncode and -m need one somewhere in the workspace (imports are not\nchecked by path). Shell scripts need no EXEC, since the shell checks\neach of their commands like a typed one; a ./script whose shebang\nnames python3 reaches python3, which does check.","default":"write","uniqueKey":"config.oneOf.0.mode","typeLabel":"enum\u003cstring>"},"read":{"oneOf":[{"type":"string","title":"ReadPolicy","description":"How a mount decides whether cached bytes may be served.\n\nFRESH revalidates against the backend's content token before serving\na cached copy; BOUNDED serves without revalidating, within the\nstaleness bound the mount declares.\n\nPINNED names the content a commit's fingerprint records. There is no\nversion layer to pin to, so a mount declaring it is refused at mount\ntime rather than quietly degraded to head: the vocabulary is\npublished, so someone will type it, and an informative refusal costs\none branch over a generic invalid-value error.","enum":["fresh","bounded","pinned"],"uniqueKey":"config.oneOf.0.read.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","uniqueKey":"config.oneOf.0.read.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.read","typeLabel":"enum\u003cstring> | null"},"write":{"oneOf":[{"type":"string","title":"WritePolicy","description":"Whether a mount's writes carry the version they were based on.\n\nUNCONDITIONAL replacements use last-write-wins. Shared rewrites that\nobserved a missing file require atomic create-only under either policy.\nCONDITIONAL writes send the version the mount last saw for the path\n(the backend's native precondition, If-Match on the S3 family), so a\nwrite based on a stale read is refused instead of overwriting the newer\nbytes. STAGED names a staging layer mirage does not have; a mount declaring it is\nrefused at mount time, as ``read: pinned`` is.","enum":["unconditional","conditional","staged"],"uniqueKey":"config.oneOf.0.write.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","uniqueKey":"config.oneOf.0.write.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.write","typeLabel":"enum\u003cstring> | null"},"default_session_id":{"oneOf":[{"type":"string","title":"Default Session Id","uniqueKey":"config.oneOf.0.default_session_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Default Session Id","uniqueKey":"config.oneOf.0.default_session_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.default_session_id","typeLabel":"string | null"},"workspace_id":{"oneOf":[{"type":"string","title":"Workspace Id","uniqueKey":"config.oneOf.0.workspace_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Workspace Id","uniqueKey":"config.oneOf.0.workspace_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.workspace_id","typeLabel":"string | null"},"cache":{"oneOf":[{"type":"object","title":"RamCacheBlock","properties":{"type":{"type":"string","const":"ram","title":"Type","default":"ram","uniqueKey":"config.oneOf.0.cache.oneOf.0.type","typeLabel":"string"},"limit":{"oneOf":[{"type":"string","title":"Limit","default":"32MB","uniqueKey":"config.oneOf.0.cache.oneOf.0.limit.oneOf.0","typeLabel":"string"},{"type":"integer","title":"Limit","default":"32MB","uniqueKey":"config.oneOf.0.cache.oneOf.0.limit.oneOf.1","typeLabel":"integer"}],"uniqueKey":"config.oneOf.0.cache.oneOf.0.limit","typeLabel":"string | integer"},"max_drain_bytes":{"oneOf":[{"type":"integer","title":"Max Drain Bytes","uniqueKey":"config.oneOf.0.cache.oneOf.0.max_drain_bytes.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max Drain Bytes","uniqueKey":"config.oneOf.0.cache.oneOf.0.max_drain_bytes.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.cache.oneOf.0.max_drain_bytes","typeLabel":"integer | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.cache.oneOf.0","typeLabel":"RamCacheBlock · object"},{"type":"object","title":"RedisCacheBlock","required":["type"],"properties":{"type":{"type":"string","const":"redis","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.cache.oneOf.1.type","typeLabel":"string"},"limit":{"oneOf":[{"type":"string","title":"Limit","default":"512MB","uniqueKey":"config.oneOf.0.cache.oneOf.1.limit.oneOf.0","typeLabel":"string"},{"type":"integer","title":"Limit","default":"512MB","uniqueKey":"config.oneOf.0.cache.oneOf.1.limit.oneOf.1","typeLabel":"integer"}],"uniqueKey":"config.oneOf.0.cache.oneOf.1.limit","typeLabel":"string | integer"},"max_drain_bytes":{"oneOf":[{"type":"integer","title":"Max Drain Bytes","uniqueKey":"config.oneOf.0.cache.oneOf.1.max_drain_bytes.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Max Drain Bytes","uniqueKey":"config.oneOf.0.cache.oneOf.1.max_drain_bytes.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.cache.oneOf.1.max_drain_bytes","typeLabel":"integer | null"},"url":{"type":"string","title":"Url","default":"redis://localhost:6379/0","uniqueKey":"config.oneOf.0.cache.oneOf.1.url","typeLabel":"string"},"key_prefix":{"oneOf":[{"type":"string","title":"Key Prefix","uniqueKey":"config.oneOf.0.cache.oneOf.1.key_prefix.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key Prefix","uniqueKey":"config.oneOf.0.cache.oneOf.1.key_prefix.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.cache.oneOf.1.key_prefix","typeLabel":"string | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.cache.oneOf.1","typeLabel":"RedisCacheBlock · object"},{"type":"null","title":"Cache","uniqueKey":"config.oneOf.0.cache.oneOf.2","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.cache","typeLabel":"RamCacheBlock · object | RedisCacheBlock · object | null"},"index":{"oneOf":[{"type":"object","title":"RamIndexBlock","properties":{"type":{"type":"string","const":"ram","title":"Type","default":"ram","uniqueKey":"config.oneOf.0.index.oneOf.0.type","typeLabel":"string"},"ttl":{"type":"number","title":"Ttl","default":600,"uniqueKey":"config.oneOf.0.index.oneOf.0.ttl","typeLabel":"number"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.index.oneOf.0","typeLabel":"RamIndexBlock · object"},{"type":"object","title":"RedisIndexBlock","required":["type"],"properties":{"type":{"type":"string","const":"redis","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.index.oneOf.1.type","typeLabel":"string"},"ttl":{"type":"number","title":"Ttl","default":600,"uniqueKey":"config.oneOf.0.index.oneOf.1.ttl","typeLabel":"number"},"url":{"type":"string","title":"Url","default":"redis://localhost:6379/0","uniqueKey":"config.oneOf.0.index.oneOf.1.url","typeLabel":"string"},"key_prefix":{"oneOf":[{"type":"string","title":"Key Prefix","uniqueKey":"config.oneOf.0.index.oneOf.1.key_prefix.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key Prefix","uniqueKey":"config.oneOf.0.index.oneOf.1.key_prefix.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.index.oneOf.1.key_prefix","typeLabel":"string | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.index.oneOf.1","typeLabel":"RedisIndexBlock · object"},{"type":"null","title":"Index","uniqueKey":"config.oneOf.0.index.oneOf.2","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.index","typeLabel":"RamIndexBlock · object | RedisIndexBlock · object | null"},"store":{"oneOf":[{"type":"object","title":"StoreBlock","description":"The workspace state store: one block, five planes.\n\nThe top-level type/url/key_prefix pick the default backend for\nevery control-plane group (namespace nodes, observer events,\nsessions + workspace metadata, jobs). The optional per-group\noverrides redirect one group to a different backend, e.g. large\nobserver logs to a separate server. Sessions and workspace metadata\nmove together by design (the default-session pointer must live\nbeside the session table it points into), so there is one\n`workspace` override, not two. An ``s3`` group hosts only the\nsessions+meta group (conditional-PUT CAS), so it is valid as the\n``workspace`` override, never as the top-level default. A ``disk``\nstore hosts the other planes under ``root`` (lockfile CAS,\nmachine-local) and keeps jobs in memory, since a job's console is a\nstream other processes follow; ``root`` is only read when a disk\nstore is selected. The ``jobs`` group (job lists, consoles, owner\nleases) is therefore ram or redis.","properties":{"type":{"type":"string","enum":["ram","disk","redis"],"title":"Type","default":"ram","uniqueKey":"config.oneOf.0.store.oneOf.0.type","typeLabel":"enum\u003cstring>"},"url":{"type":"string","title":"Url","default":"redis://localhost:6379/0","uniqueKey":"config.oneOf.0.store.oneOf.0.url","typeLabel":"string"},"key_prefix":{"type":"string","title":"Key Prefix","default":"mirage:","uniqueKey":"config.oneOf.0.store.oneOf.0.key_prefix","typeLabel":"string"},"root":{"type":"string","title":"Root","default":"~/.mirage/state","uniqueKey":"config.oneOf.0.store.oneOf.0.root","typeLabel":"string"},"namespace":{"oneOf":[{"type":"object","title":"RamStoreBlock","properties":{"type":{"type":"string","const":"ram","title":"Type","default":"ram","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.0.type","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.0","typeLabel":"RamStoreBlock · object"},{"type":"object","title":"DiskStoreBlock","required":["type"],"properties":{"type":{"type":"string","const":"disk","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.1.type","typeLabel":"string"},"root":{"type":"string","title":"Root","default":"~/.mirage/state","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.1.root","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.1","typeLabel":"DiskStoreBlock · object"},{"type":"object","title":"RedisStoreBlock","required":["type"],"properties":{"type":{"type":"string","const":"redis","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.2.type","typeLabel":"string"},"url":{"type":"string","title":"Url","default":"redis://localhost:6379/0","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.2.url","typeLabel":"string"},"key_prefix":{"type":"string","title":"Key Prefix","default":"mirage:","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.2.key_prefix","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.2","typeLabel":"RedisStoreBlock · object"},{"type":"object","title":"S3StoreBlock","description":"An ``S3Config`` plus the union discriminator: the block IS the\nbackend config, so new S3Config fields flow into the store block\nwithout re-declaring them here.","required":["bucket","type"],"properties":{"bucket":{"type":"string","title":"Bucket","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.bucket","typeLabel":"string"},"type":{"type":"string","const":"s3","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.type","typeLabel":"string"},"timeout":{"type":"number","exclusiveMinimum":0,"title":"Timeout","default":30,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.timeout","typeLabel":"number"},"region":{"oneOf":[{"type":"string","title":"Region","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.region.oneOf.0","typeLabel":"string"},{"type":"null","title":"Region","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.region.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.region","typeLabel":"string | null"},"aws_access_key_id":{"oneOf":[{"type":"string","title":"Aws Access Key Id","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_access_key_id.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Access Key Id","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_access_key_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_access_key_id","typeLabel":"string\u003cpassword> | null"},"aws_secret_access_key":{"oneOf":[{"type":"string","title":"Aws Secret Access Key","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_secret_access_key.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Secret Access Key","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_secret_access_key.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_secret_access_key","typeLabel":"string\u003cpassword> | null"},"aws_session_token":{"oneOf":[{"type":"string","title":"Aws Session Token","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_session_token.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Session Token","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_session_token.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_session_token","typeLabel":"string\u003cpassword> | null"},"aws_profile":{"oneOf":[{"type":"string","title":"Aws Profile","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_profile.oneOf.0","typeLabel":"string"},{"type":"null","title":"Aws Profile","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_profile.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.aws_profile","typeLabel":"string | null"},"endpoint_url":{"oneOf":[{"type":"string","title":"Endpoint Url","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.endpoint_url.oneOf.0","typeLabel":"string"},{"type":"null","title":"Endpoint Url","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.endpoint_url.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.endpoint_url","typeLabel":"string | null"},"path_style":{"type":"boolean","title":"Path Style","default":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.path_style","typeLabel":"boolean"},"proxy":{"oneOf":[{"type":"string","title":"Proxy","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.proxy.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Proxy","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.proxy.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.proxy","typeLabel":"string\u003cpassword> | null"},"key_prefix":{"oneOf":[{"type":"string","title":"Key Prefix","default":"mirage/","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.key_prefix.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key Prefix","default":"mirage/","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.key_prefix.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.key_prefix","typeLabel":"string | null"},"default_content_type":{"oneOf":[{"type":"string","title":"Default Content Type","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.default_content_type.oneOf.0","typeLabel":"string"},{"type":"null","title":"Default Content Type","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.default_content_type.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3.default_content_type","typeLabel":"string | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.3","typeLabel":"S3StoreBlock · object"},{"type":"null","title":"Namespace","uniqueKey":"config.oneOf.0.store.oneOf.0.namespace.oneOf.4","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.namespace","typeLabel":"RamStoreBlock · object | DiskStoreBlock · object | RedisStoreBlock · object | S3StoreBlock · object | null"},"observer":{"oneOf":[{"type":"object","title":"RamStoreBlock","properties":{"type":{"type":"string","const":"ram","title":"Type","default":"ram","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.0.type","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.0","typeLabel":"RamStoreBlock · object"},{"type":"object","title":"DiskStoreBlock","required":["type"],"properties":{"type":{"type":"string","const":"disk","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.1.type","typeLabel":"string"},"root":{"type":"string","title":"Root","default":"~/.mirage/state","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.1.root","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.1","typeLabel":"DiskStoreBlock · object"},{"type":"object","title":"RedisStoreBlock","required":["type"],"properties":{"type":{"type":"string","const":"redis","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.2.type","typeLabel":"string"},"url":{"type":"string","title":"Url","default":"redis://localhost:6379/0","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.2.url","typeLabel":"string"},"key_prefix":{"type":"string","title":"Key Prefix","default":"mirage:","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.2.key_prefix","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.2","typeLabel":"RedisStoreBlock · object"},{"type":"object","title":"S3StoreBlock","description":"An ``S3Config`` plus the union discriminator: the block IS the\nbackend config, so new S3Config fields flow into the store block\nwithout re-declaring them here.","required":["bucket","type"],"properties":{"bucket":{"type":"string","title":"Bucket","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.bucket","typeLabel":"string"},"type":{"type":"string","const":"s3","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.type","typeLabel":"string"},"timeout":{"type":"number","exclusiveMinimum":0,"title":"Timeout","default":30,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.timeout","typeLabel":"number"},"region":{"oneOf":[{"type":"string","title":"Region","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.region.oneOf.0","typeLabel":"string"},{"type":"null","title":"Region","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.region.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.region","typeLabel":"string | null"},"aws_access_key_id":{"oneOf":[{"type":"string","title":"Aws Access Key Id","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_access_key_id.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Access Key Id","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_access_key_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_access_key_id","typeLabel":"string\u003cpassword> | null"},"aws_secret_access_key":{"oneOf":[{"type":"string","title":"Aws Secret Access Key","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_secret_access_key.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Secret Access Key","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_secret_access_key.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_secret_access_key","typeLabel":"string\u003cpassword> | null"},"aws_session_token":{"oneOf":[{"type":"string","title":"Aws Session Token","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_session_token.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Session Token","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_session_token.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_session_token","typeLabel":"string\u003cpassword> | null"},"aws_profile":{"oneOf":[{"type":"string","title":"Aws Profile","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_profile.oneOf.0","typeLabel":"string"},{"type":"null","title":"Aws Profile","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_profile.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.aws_profile","typeLabel":"string | null"},"endpoint_url":{"oneOf":[{"type":"string","title":"Endpoint Url","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.endpoint_url.oneOf.0","typeLabel":"string"},{"type":"null","title":"Endpoint Url","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.endpoint_url.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.endpoint_url","typeLabel":"string | null"},"path_style":{"type":"boolean","title":"Path Style","default":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.path_style","typeLabel":"boolean"},"proxy":{"oneOf":[{"type":"string","title":"Proxy","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.proxy.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Proxy","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.proxy.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.proxy","typeLabel":"string\u003cpassword> | null"},"key_prefix":{"oneOf":[{"type":"string","title":"Key Prefix","default":"mirage/","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.key_prefix.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key Prefix","default":"mirage/","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.key_prefix.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.key_prefix","typeLabel":"string | null"},"default_content_type":{"oneOf":[{"type":"string","title":"Default Content Type","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.default_content_type.oneOf.0","typeLabel":"string"},{"type":"null","title":"Default Content Type","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.default_content_type.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3.default_content_type","typeLabel":"string | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.3","typeLabel":"S3StoreBlock · object"},{"type":"null","title":"Observer","uniqueKey":"config.oneOf.0.store.oneOf.0.observer.oneOf.4","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.observer","typeLabel":"RamStoreBlock · object | DiskStoreBlock · object | RedisStoreBlock · object | S3StoreBlock · object | null"},"workspace":{"oneOf":[{"type":"object","title":"RamStoreBlock","properties":{"type":{"type":"string","const":"ram","title":"Type","default":"ram","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.0.type","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.0","typeLabel":"RamStoreBlock · object"},{"type":"object","title":"DiskStoreBlock","required":["type"],"properties":{"type":{"type":"string","const":"disk","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.1.type","typeLabel":"string"},"root":{"type":"string","title":"Root","default":"~/.mirage/state","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.1.root","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.1","typeLabel":"DiskStoreBlock · object"},{"type":"object","title":"RedisStoreBlock","required":["type"],"properties":{"type":{"type":"string","const":"redis","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.2.type","typeLabel":"string"},"url":{"type":"string","title":"Url","default":"redis://localhost:6379/0","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.2.url","typeLabel":"string"},"key_prefix":{"type":"string","title":"Key Prefix","default":"mirage:","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.2.key_prefix","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.2","typeLabel":"RedisStoreBlock · object"},{"type":"object","title":"S3StoreBlock","description":"An ``S3Config`` plus the union discriminator: the block IS the\nbackend config, so new S3Config fields flow into the store block\nwithout re-declaring them here.","required":["bucket","type"],"properties":{"bucket":{"type":"string","title":"Bucket","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.bucket","typeLabel":"string"},"type":{"type":"string","const":"s3","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.type","typeLabel":"string"},"timeout":{"type":"number","exclusiveMinimum":0,"title":"Timeout","default":30,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.timeout","typeLabel":"number"},"region":{"oneOf":[{"type":"string","title":"Region","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.region.oneOf.0","typeLabel":"string"},{"type":"null","title":"Region","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.region.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.region","typeLabel":"string | null"},"aws_access_key_id":{"oneOf":[{"type":"string","title":"Aws Access Key Id","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_access_key_id.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Access Key Id","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_access_key_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_access_key_id","typeLabel":"string\u003cpassword> | null"},"aws_secret_access_key":{"oneOf":[{"type":"string","title":"Aws Secret Access Key","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_secret_access_key.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Secret Access Key","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_secret_access_key.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_secret_access_key","typeLabel":"string\u003cpassword> | null"},"aws_session_token":{"oneOf":[{"type":"string","title":"Aws Session Token","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_session_token.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Session Token","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_session_token.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_session_token","typeLabel":"string\u003cpassword> | null"},"aws_profile":{"oneOf":[{"type":"string","title":"Aws Profile","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_profile.oneOf.0","typeLabel":"string"},{"type":"null","title":"Aws Profile","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_profile.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.aws_profile","typeLabel":"string | null"},"endpoint_url":{"oneOf":[{"type":"string","title":"Endpoint Url","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.endpoint_url.oneOf.0","typeLabel":"string"},{"type":"null","title":"Endpoint Url","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.endpoint_url.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.endpoint_url","typeLabel":"string | null"},"path_style":{"type":"boolean","title":"Path Style","default":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.path_style","typeLabel":"boolean"},"proxy":{"oneOf":[{"type":"string","title":"Proxy","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.proxy.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Proxy","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.proxy.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.proxy","typeLabel":"string\u003cpassword> | null"},"key_prefix":{"oneOf":[{"type":"string","title":"Key Prefix","default":"mirage/","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.key_prefix.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key Prefix","default":"mirage/","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.key_prefix.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.key_prefix","typeLabel":"string | null"},"default_content_type":{"oneOf":[{"type":"string","title":"Default Content Type","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.default_content_type.oneOf.0","typeLabel":"string"},{"type":"null","title":"Default Content Type","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.default_content_type.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3.default_content_type","typeLabel":"string | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.3","typeLabel":"S3StoreBlock · object"},{"type":"null","title":"Workspace","uniqueKey":"config.oneOf.0.store.oneOf.0.workspace.oneOf.4","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.workspace","typeLabel":"RamStoreBlock · object | DiskStoreBlock · object | RedisStoreBlock · object | S3StoreBlock · object | null"},"jobs":{"oneOf":[{"type":"object","title":"RamStoreBlock","properties":{"type":{"type":"string","const":"ram","title":"Type","default":"ram","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.0.type","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.0","typeLabel":"RamStoreBlock · object"},{"type":"object","title":"DiskStoreBlock","required":["type"],"properties":{"type":{"type":"string","const":"disk","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.1.type","typeLabel":"string"},"root":{"type":"string","title":"Root","default":"~/.mirage/state","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.1.root","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.1","typeLabel":"DiskStoreBlock · object"},{"type":"object","title":"RedisStoreBlock","required":["type"],"properties":{"type":{"type":"string","const":"redis","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.2.type","typeLabel":"string"},"url":{"type":"string","title":"Url","default":"redis://localhost:6379/0","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.2.url","typeLabel":"string"},"key_prefix":{"type":"string","title":"Key Prefix","default":"mirage:","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.2.key_prefix","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.2","typeLabel":"RedisStoreBlock · object"},{"type":"object","title":"S3StoreBlock","description":"An ``S3Config`` plus the union discriminator: the block IS the\nbackend config, so new S3Config fields flow into the store block\nwithout re-declaring them here.","required":["bucket","type"],"properties":{"bucket":{"type":"string","title":"Bucket","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.bucket","typeLabel":"string"},"type":{"type":"string","const":"s3","title":"Type","isRequired":true,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.type","typeLabel":"string"},"timeout":{"type":"number","exclusiveMinimum":0,"title":"Timeout","default":30,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.timeout","typeLabel":"number"},"region":{"oneOf":[{"type":"string","title":"Region","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.region.oneOf.0","typeLabel":"string"},{"type":"null","title":"Region","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.region.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.region","typeLabel":"string | null"},"aws_access_key_id":{"oneOf":[{"type":"string","title":"Aws Access Key Id","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_access_key_id.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Access Key Id","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_access_key_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_access_key_id","typeLabel":"string\u003cpassword> | null"},"aws_secret_access_key":{"oneOf":[{"type":"string","title":"Aws Secret Access Key","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_secret_access_key.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Secret Access Key","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_secret_access_key.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_secret_access_key","typeLabel":"string\u003cpassword> | null"},"aws_session_token":{"oneOf":[{"type":"string","title":"Aws Session Token","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_session_token.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Aws Session Token","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_session_token.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_session_token","typeLabel":"string\u003cpassword> | null"},"aws_profile":{"oneOf":[{"type":"string","title":"Aws Profile","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_profile.oneOf.0","typeLabel":"string"},{"type":"null","title":"Aws Profile","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_profile.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.aws_profile","typeLabel":"string | null"},"endpoint_url":{"oneOf":[{"type":"string","title":"Endpoint Url","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.endpoint_url.oneOf.0","typeLabel":"string"},{"type":"null","title":"Endpoint Url","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.endpoint_url.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.endpoint_url","typeLabel":"string | null"},"path_style":{"type":"boolean","title":"Path Style","default":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.path_style","typeLabel":"boolean"},"proxy":{"oneOf":[{"type":"string","title":"Proxy","format":"password","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.proxy.oneOf.0","typeLabel":"string\u003cpassword>"},{"type":"null","title":"Proxy","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.proxy.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.proxy","typeLabel":"string\u003cpassword> | null"},"key_prefix":{"oneOf":[{"type":"string","title":"Key Prefix","default":"mirage/","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.key_prefix.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key Prefix","default":"mirage/","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.key_prefix.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.key_prefix","typeLabel":"string | null"},"default_content_type":{"oneOf":[{"type":"string","title":"Default Content Type","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.default_content_type.oneOf.0","typeLabel":"string"},{"type":"null","title":"Default Content Type","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.default_content_type.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3.default_content_type","typeLabel":"string | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.3","typeLabel":"S3StoreBlock · object"},{"type":"null","title":"Jobs","uniqueKey":"config.oneOf.0.store.oneOf.0.jobs.oneOf.4","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store.oneOf.0.jobs","typeLabel":"RamStoreBlock · object | DiskStoreBlock · object | RedisStoreBlock · object | S3StoreBlock · object | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.store.oneOf.0","typeLabel":"StoreBlock · object"},{"type":"null","uniqueKey":"config.oneOf.0.store.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.store","typeLabel":"StoreBlock · object | null"},"env":{"oneOf":[{"type":"object","title":"Env","additionalProperties":{"oneOf":[{"type":"string","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.0","typeLabel":"string"},{"type":"object","title":"EnvVar","description":"One entry of the env map: a literal value or a managed pointer.\n\nThe env block is one map, name -> entry. A bare string in the map\nis the literal short form and never reaches this model; a dict is\nvalidated through it. `value` and `from` are mutually exclusive and\none is required: `export` belongs to a literal entry, `ref`/`key`/\n`fetch` to a managed one, and `readonly` to either.\n\nArgs:\n value (str | None): the literal text; set = a literal entry.\n readonly (bool): compiles to `VarAttr.READONLY`, so the agent\n cannot assign to the name or unset it. Legal on a managed\n entry too, and the point of one: the fetch writes the\n record itself rather than going through the shell's\n assignment gate, so mirage still fills a readonly\n credential while a line that tries to overwrite it is\n refused.\n export (bool): literal-only knob (default on); a managed entry\n is always exported.\n provider (str | None): registered source name; set = a managed\n entry. Spelled `from:` in YAML (python keyword), via alias.\n ref (str): the source's address for the secret.\n key (str | None): which secret field to read; default the\n variable's own name.\n fetch (Literal[\"lazy\", \"eager\"]): eager joins every line's\n fetch set instead of waiting for a reference.","properties":{"value":{"oneOf":[{"type":"string","title":"Value","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.value.oneOf.0","typeLabel":"string"},{"type":"null","title":"Value","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.value.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.value","typeLabel":"string | null"},"readonly":{"type":"boolean","title":"Readonly","default":false,"uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.readonly","typeLabel":"boolean"},"export":{"type":"boolean","title":"Export","default":true,"uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.export","typeLabel":"boolean"},"from":{"oneOf":[{"type":"string","title":"From","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.from.oneOf.0","typeLabel":"string"},{"type":"null","title":"From","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.from.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.from","typeLabel":"string | null"},"ref":{"type":"string","title":"Ref","default":"","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.ref","typeLabel":"string"},"key":{"oneOf":[{"type":"string","title":"Key","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.key.oneOf.0","typeLabel":"string"},{"type":"null","title":"Key","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.key.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.key","typeLabel":"string | null"},"fetch":{"type":"string","enum":["lazy","eager"],"title":"Fetch","default":"lazy","uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1.fetch","typeLabel":"enum\u003cstring>"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties.oneOf.1","typeLabel":"EnvVar · object"}],"uniqueKey":"config.oneOf.0.env.oneOf.0.additionalProperties","typeLabel":"string | EnvVar · object"},"uniqueKey":"config.oneOf.0.env.oneOf.0","typeLabel":"Env · object"},{"type":"null","title":"Env","uniqueKey":"config.oneOf.0.env.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.env","typeLabel":"Env · object | null"},"secrets":{"oneOf":[{"type":"object","title":"Secrets","additionalProperties":{"properties":{"source":{"type":"string","title":"Source","isRequired":true,"uniqueKey":"config.oneOf.0.secrets.oneOf.0.additionalProperties.source","typeLabel":"string"},"config":{"additionalProperties":true,"type":"object","title":"Config","uniqueKey":"config.oneOf.0.secrets.oneOf.0.additionalProperties.config","typeLabel":"Config · object"}},"additionalProperties":false,"type":"object","required":["source"],"title":"SecretSource","description":"One declared source instance: which source, and its config.\n\nThe `secrets:` block is one map, name -> source, spelled the way\n`mounts:` and `clis:` are: a type beside a config. The\ninstance name is what a managed env entry's `from:` names, so two\naccounts of one platform are two instances, and an instance named\nafter its source reads as that source configured.\n\nThe config map is untyped here, the way `mounts.*.config` is: each\nsource owns its own model, and this block only has to tell a\npointer from a literal. It does that the way the env plane does,\nby the presence of `from`, so a mapping carrying one is validated\nas a `SecretRef` and every other value passes through to the\nsource's model.\n\nArgs:\n source (str): the registered source this instance speaks to.\n config (dict[str, Any]): the source's own config fields; a\n value may be a literal or a `SecretRef`.","uniqueKey":"config.oneOf.0.secrets.oneOf.0.additionalProperties","typeLabel":"SecretSource · object"},"uniqueKey":"config.oneOf.0.secrets.oneOf.0","typeLabel":"Secrets · object"},{"type":"null","title":"Secrets","uniqueKey":"config.oneOf.0.secrets.oneOf.1","typeLabel":"null"}],"uniqueKey":"config.oneOf.0.secrets","typeLabel":"Secrets · object | null"}},"additionalProperties":false,"uniqueKey":"config.oneOf.0","typeLabel":"WorkspaceConfig · object"},{"type":"null","uniqueKey":"config.oneOf.1","typeLabel":"null"}],"uniqueKey":"config","typeLabel":"WorkspaceConfig · object | null"},"template":{"oneOf":[{"type":"string","title":"Template","uniqueKey":"template.oneOf.0","typeLabel":"string"},{"type":"null","title":"Template","uniqueKey":"template.oneOf.1","typeLabel":"null"}],"uniqueKey":"template","typeLabel":"string | null"},"id":{"oneOf":[{"type":"string","title":"Id","uniqueKey":"id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Id","uniqueKey":"id.oneOf.1","typeLabel":"null"}],"uniqueKey":"id","typeLabel":"string | null"}},"additionalProperties":false,"type":"object","title":"CreateWorkspaceRequest","description":"A workspace to create: from ``config``, or from the saved\n``template`` of that name, never both.","uniqueKey":"","typeLabel":"CreateWorkspaceRequest · object"},"examples":{"Example":{"title":"Example","value":{"config":{"mounts":{},"io":{"buffer_bytes":65536},"command_limits":{},"max_memory":"\u003cstring>","max_body_bytes":"\u003cstring>","max_env":"\u003cstring>","network":true,"system_time":"\u003cstring>","clis":{},"runtimes":["\u003cstring>"],"route_policy":{"script":{"source":"\u003cstring>","language":"python","module":false},"runtime":"monty","env":{}},"profiles":{},"profile":"\u003cstring>","processes":{"list":"session","kill":"session","max":128},"mode":"write","default_session_id":"\u003cstring>","workspace_id":"\u003cstring>","cache":{"type":"ram","limit":"32MB","max_drain_bytes":123},"index":{"type":"ram","ttl":600},"store":{"type":"ram","url":"redis://localhost:6379/0","key_prefix":"mirage:","root":"~/.mirage/state","namespace":{"type":"ram"},"observer":{"type":"ram"},"workspace":{"type":"ram"},"jobs":{"type":"ram"}},"env":{},"secrets":{}},"template":"\u003cstring>","id":"\u003cstring>"}}},"exampleType":"generated"}},"exampleType":"generated"},"responses":{"a01bbb98-942c-4479-84ea-25dcd4c4579d":{"description":"An identical retry answers the existing workspace; with explain=true, what the server's policies say about the config","content":{"application/json":{"schema":{"oneOf":[{"type":"object","title":"WorkspaceDetail","required":["id","mode","created_at"],"properties":{"id":{"type":"string","title":"Id","isRequired":true,"uniqueKey":"oneOf.0.id","typeLabel":"string"},"mode":{"type":"string","title":"Mode","isRequired":true,"uniqueKey":"oneOf.0.mode","typeLabel":"string"},"created_at":{"type":"number","title":"Created At","isRequired":true,"uniqueKey":"oneOf.0.created_at","typeLabel":"number"},"fuse_mountpoints":{"additionalProperties":{"type":"string","uniqueKey":"oneOf.0.fuse_mountpoints.additionalProperties","typeLabel":"string"},"type":"object","title":"Fuse Mountpoints","uniqueKey":"oneOf.0.fuse_mountpoints","typeLabel":"Fuse Mountpoints · object"},"system_time":{"oneOf":[{"type":"string","title":"System Time","uniqueKey":"oneOf.0.system_time.oneOf.0","typeLabel":"string"},{"type":"null","title":"System Time","uniqueKey":"oneOf.0.system_time.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.system_time","typeLabel":"string | null"},"sessions":{"items":{"properties":{"session_id":{"type":"string","title":"Session Id","isRequired":true,"uniqueKey":"oneOf.0.sessions.items.[INDEX].session_id","typeLabel":"string"},"cwd":{"type":"string","title":"Cwd","isRequired":true,"uniqueKey":"oneOf.0.sessions.items.[INDEX].cwd","typeLabel":"string"}},"type":"object","required":["session_id","cwd"],"title":"SessionSummary","uniqueKey":"oneOf.0.sessions.items.[INDEX]","typeLabel":"SessionSummary · object"},"type":"array","title":"Sessions","uniqueKey":"oneOf.0.sessions","typeLabel":"SessionSummary · object[]"},"mounts":{"items":{"properties":{"prefix":{"type":"string","title":"Prefix","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].prefix","typeLabel":"string"},"vfs":{"type":"string","title":"Vfs","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].vfs","typeLabel":"string"},"mode":{"type":"string","title":"Mode","isRequired":true,"uniqueKey":"oneOf.0.mounts.items.[INDEX].mode","typeLabel":"string"},"description":{"type":"string","title":"Description","default":"","uniqueKey":"oneOf.0.mounts.items.[INDEX].description","typeLabel":"string"}},"type":"object","required":["prefix","vfs","mode"],"title":"MountSummary","uniqueKey":"oneOf.0.mounts.items.[INDEX]","typeLabel":"MountSummary · object"},"type":"array","title":"Mounts","uniqueKey":"oneOf.0.mounts","typeLabel":"MountSummary · object[]"},"internals":{"oneOf":[{"type":"object","title":"WorkspaceInternals","required":["cache_bytes","cache_entries","history_length","in_flight_jobs"],"properties":{"cache_bytes":{"oneOf":[{"type":"integer","title":"Cache Bytes","isRequired":true,"uniqueKey":"oneOf.0.internals.oneOf.0.cache_bytes.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Cache Bytes","isRequired":true,"uniqueKey":"oneOf.0.internals.oneOf.0.cache_bytes.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"oneOf.0.internals.oneOf.0.cache_bytes","typeLabel":"integer | null"},"cache_entries":{"oneOf":[{"type":"integer","title":"Cache Entries","isRequired":true,"uniqueKey":"oneOf.0.internals.oneOf.0.cache_entries.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Cache Entries","isRequired":true,"uniqueKey":"oneOf.0.internals.oneOf.0.cache_entries.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"oneOf.0.internals.oneOf.0.cache_entries","typeLabel":"integer | null"},"history_length":{"type":"integer","title":"History Length","isRequired":true,"uniqueKey":"oneOf.0.internals.oneOf.0.history_length","typeLabel":"integer"},"in_flight_jobs":{"type":"integer","title":"In Flight Jobs","isRequired":true,"uniqueKey":"oneOf.0.internals.oneOf.0.in_flight_jobs","typeLabel":"integer"}},"uniqueKey":"oneOf.0.internals.oneOf.0","typeLabel":"WorkspaceInternals · object"},{"type":"null","uniqueKey":"oneOf.0.internals.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.0.internals","typeLabel":"WorkspaceInternals · object | null"}},"uniqueKey":"oneOf.0","typeLabel":"WorkspaceDetail · object"},{"type":"object","uniqueKey":"oneOf.1","typeLabel":"object"}],"uniqueKey":"","typeLabel":"WorkspaceDetail · object | object"},"examples":{"Example":{"title":"Example","value":{"id":"\u003cstring>","mode":"\u003cstring>","created_at":123,"fuse_mountpoints":{},"system_time":"\u003cstring>","sessions":[{"session_id":"\u003cstring>","cwd":"\u003cstring>"}],"mounts":[{"prefix":"\u003cstring>","vfs":"\u003cstring>","mode":"\u003cstring>","description":""}],"internals":{"cache_bytes":123,"cache_entries":123,"history_length":123,"in_flight_jobs":123}}}},"exampleType":"generated"}},"exampleType":"generated"},"8e5d0eb3-3b25-4705-870a-1ae8e6da0daf":{"description":"Created","content":{"application/json":{"schema":{"properties":{"id":{"type":"string","title":"Id","isRequired":true,"uniqueKey":"id","typeLabel":"string"},"mode":{"type":"string","title":"Mode","isRequired":true,"uniqueKey":"mode","typeLabel":"string"},"created_at":{"type":"number","title":"Created At","isRequired":true,"uniqueKey":"created_at","typeLabel":"number"},"fuse_mountpoints":{"additionalProperties":{"type":"string","uniqueKey":"fuse_mountpoints.additionalProperties","typeLabel":"string"},"type":"object","title":"Fuse Mountpoints","uniqueKey":"fuse_mountpoints","typeLabel":"Fuse Mountpoints · object"},"system_time":{"oneOf":[{"type":"string","title":"System Time","uniqueKey":"system_time.oneOf.0","typeLabel":"string"},{"type":"null","title":"System Time","uniqueKey":"system_time.oneOf.1","typeLabel":"null"}],"uniqueKey":"system_time","typeLabel":"string | null"},"sessions":{"items":{"properties":{"session_id":{"type":"string","title":"Session Id","isRequired":true,"uniqueKey":"sessions.items.[INDEX].session_id","typeLabel":"string"},"cwd":{"type":"string","title":"Cwd","isRequired":true,"uniqueKey":"sessions.items.[INDEX].cwd","typeLabel":"string"}},"type":"object","required":["session_id","cwd"],"title":"SessionSummary","uniqueKey":"sessions.items.[INDEX]","typeLabel":"SessionSummary · object"},"type":"array","title":"Sessions","uniqueKey":"sessions","typeLabel":"SessionSummary · object[]"},"mounts":{"items":{"properties":{"prefix":{"type":"string","title":"Prefix","isRequired":true,"uniqueKey":"mounts.items.[INDEX].prefix","typeLabel":"string"},"vfs":{"type":"string","title":"Vfs","isRequired":true,"uniqueKey":"mounts.items.[INDEX].vfs","typeLabel":"string"},"mode":{"type":"string","title":"Mode","isRequired":true,"uniqueKey":"mounts.items.[INDEX].mode","typeLabel":"string"},"description":{"type":"string","title":"Description","default":"","uniqueKey":"mounts.items.[INDEX].description","typeLabel":"string"}},"type":"object","required":["prefix","vfs","mode"],"title":"MountSummary","uniqueKey":"mounts.items.[INDEX]","typeLabel":"MountSummary · object"},"type":"array","title":"Mounts","uniqueKey":"mounts","typeLabel":"MountSummary · object[]"},"internals":{"oneOf":[{"type":"object","title":"WorkspaceInternals","required":["cache_bytes","cache_entries","history_length","in_flight_jobs"],"properties":{"cache_bytes":{"oneOf":[{"type":"integer","title":"Cache Bytes","isRequired":true,"uniqueKey":"internals.oneOf.0.cache_bytes.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Cache Bytes","isRequired":true,"uniqueKey":"internals.oneOf.0.cache_bytes.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"internals.oneOf.0.cache_bytes","typeLabel":"integer | null"},"cache_entries":{"oneOf":[{"type":"integer","title":"Cache Entries","isRequired":true,"uniqueKey":"internals.oneOf.0.cache_entries.oneOf.0","typeLabel":"integer"},{"type":"null","title":"Cache Entries","isRequired":true,"uniqueKey":"internals.oneOf.0.cache_entries.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"internals.oneOf.0.cache_entries","typeLabel":"integer | null"},"history_length":{"type":"integer","title":"History Length","isRequired":true,"uniqueKey":"internals.oneOf.0.history_length","typeLabel":"integer"},"in_flight_jobs":{"type":"integer","title":"In Flight Jobs","isRequired":true,"uniqueKey":"internals.oneOf.0.in_flight_jobs","typeLabel":"integer"}},"uniqueKey":"internals.oneOf.0","typeLabel":"WorkspaceInternals · object"},{"type":"null","uniqueKey":"internals.oneOf.1","typeLabel":"null"}],"uniqueKey":"internals","typeLabel":"WorkspaceInternals · object | null"}},"type":"object","required":["id","mode","created_at"],"title":"WorkspaceDetail","uniqueKey":"","typeLabel":"WorkspaceDetail · object"},"examples":{"Example":{"title":"Example","value":{"id":"\u003cstring>","mode":"\u003cstring>","created_at":123,"fuse_mountpoints":{},"system_time":"\u003cstring>","sessions":[{"session_id":"\u003cstring>","cwd":"\u003cstring>"}],"mounts":[{"prefix":"\u003cstring>","vfs":"\u003cstring>","mode":"\u003cstring>","description":""}],"internals":{"cache_bytes":123,"cache_entries":123,"history_length":123,"in_flight_jobs":123}}}},"exampleType":"generated"}},"exampleType":"generated"},"ab6f961d-7457-42a4-ba6c-6e6a45852a56":{"description":"The token is missing or wrong","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"What went wrong, as text or a structured record.","isRequired":true,"uniqueKey":"detail","typeLabel":"any"},"errno":{"type":"string","description":"The errno of a failed file call, such as ENOENT.","uniqueKey":"errno","typeLabel":"string"},"refusal":{"type":"object","description":"The policy refusal, when a policy refused the call.","uniqueKey":"refusal","typeLabel":"object"}},"required":["detail"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"detail":"\u003cunknown>","errno":"\u003cstring>","refusal":{}}}},"exampleType":"generated"},"text/plain":{"schema":{"type":"string","description":"The Python daemon answers Unauthorized as plain text.","uniqueKey":"","typeLabel":"string"},"examples":{"Example":{"title":"Example","value":"\u003cstring>"}},"exampleType":"generated"}},"exampleType":"generated"},"e55c3284-82b6-4fb6-a444-a3d812a7a43e":{"description":"A policy or mount mode refused the call","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"What went wrong, as text or a structured record.","isRequired":true,"uniqueKey":"detail","typeLabel":"any"},"errno":{"type":"string","description":"The errno of a failed file call, such as ENOENT.","uniqueKey":"errno","typeLabel":"string"},"refusal":{"type":"object","description":"The policy refusal, when a policy refused the call.","uniqueKey":"refusal","typeLabel":"object"}},"required":["detail"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"detail":"\u003cunknown>","errno":"\u003cstring>","refusal":{}}}},"exampleType":"generated"}},"exampleType":"generated"},"da2eade3-3de2-4bfa-881d-db97a96a7300":{"description":"The id or name is taken, the workspace is busy, or a file changed since it was read","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"What went wrong, as text or a structured record.","isRequired":true,"uniqueKey":"detail","typeLabel":"any"},"errno":{"type":"string","description":"The errno of a failed file call, such as ENOENT.","uniqueKey":"errno","typeLabel":"string"},"refusal":{"type":"object","description":"The policy refusal, when a policy refused the call.","uniqueKey":"refusal","typeLabel":"object"}},"required":["detail"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"detail":"\u003cunknown>","errno":"\u003cstring>","refusal":{}}}},"exampleType":"generated"}},"exampleType":"generated"},"fbf7a76f-1c27-4e83-addf-e136d606979c":{"content":{"application/json":{"schema":{"properties":{"detail":{"items":{"properties":{"loc":{"items":{"oneOf":[{"type":"string","uniqueKey":"detail.items.[INDEX].loc.items.[INDEX].oneOf.0","typeLabel":"string"},{"type":"integer","uniqueKey":"detail.items.[INDEX].loc.items.[INDEX].oneOf.1","typeLabel":"integer"}],"uniqueKey":"detail.items.[INDEX].loc.items.[INDEX]","typeLabel":"string | integer"},"type":"array","title":"Location","isRequired":true,"uniqueKey":"detail.items.[INDEX].loc","typeLabel":"(string | integer)[]"},"msg":{"type":"string","title":"Message","isRequired":true,"uniqueKey":"detail.items.[INDEX].msg","typeLabel":"string"},"type":{"type":"string","title":"Error Type","isRequired":true,"uniqueKey":"detail.items.[INDEX].type","typeLabel":"string"},"input":{"oneOf":[{"title":"Input"}],"uniqueKey":"detail.items.[INDEX].input","typeLabel":"any"},"ctx":{"type":"object","title":"Context","uniqueKey":"detail.items.[INDEX].ctx","typeLabel":"Context · object"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError","uniqueKey":"detail.items.[INDEX]","typeLabel":"ValidationError · object"},"type":"array","title":"Detail","uniqueKey":"detail","typeLabel":"ValidationError · object[]"}},"type":"object","title":"HTTPValidationError","uniqueKey":"","typeLabel":"HTTPValidationError · object"},"examples":{"Example":{"title":"Example","value":{"detail":[{"loc":["\u003cstring>"],"msg":"\u003cstring>","type":"\u003cstring>","input":"\u003cunknown>","ctx":{}}]}}},"exampleType":"generated"}},"description":"Validation Error","exampleType":"generated"},"5d0fda3e-7b46-48d4-9b8f-2d17a863f335":{"description":"Past a rate limit, or a new session past max_sessions","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"What went wrong, as text or a structured record.","isRequired":true,"uniqueKey":"detail","typeLabel":"any"},"errno":{"type":"string","description":"The errno of a failed file call, such as ENOENT.","uniqueKey":"errno","typeLabel":"string"},"refusal":{"type":"object","description":"The policy refusal, when a policy refused the call.","uniqueKey":"refusal","typeLabel":"object"}},"required":["detail"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"detail":"\u003cunknown>","errno":"\u003cstring>","refusal":{}}}},"exampleType":"generated"}},"headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer","minimum":0}}},"exampleType":"generated"},"a5f8b3e4-b98d-49df-8ec6-96a8241af96c":{"description":"The server is at max_workspaces, or shutting down","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"What went wrong, as text or a structured record.","isRequired":true,"uniqueKey":"detail","typeLabel":"any"},"errno":{"type":"string","description":"The errno of a failed file call, such as ENOENT.","uniqueKey":"errno","typeLabel":"string"},"refusal":{"type":"object","description":"The policy refusal, when a policy refused the call.","uniqueKey":"refusal","typeLabel":"object"}},"required":["detail"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"detail":"\u003cunknown>","errno":"\u003cstring>","refusal":{}}}},"exampleType":"generated"}},"exampleType":"generated"}},"security":{"4159ccc1-3afa-4800-8ae3-f86840818ec3":{"bearerAuth":{"type":"http","scheme":"bearer","description":"The server's token (MIRAGE_AUTH_TOKEN) or a JWT. A daemon in the default local mode with no token accepts requests without one.","scopes":[],"schemeName":"bearerAuth"}}},"servers":{"5b646690-c8a6-470b-9b36-ade1de13789b":{"url":"http://127.0.0.1:8765","description":"A local daemon on its default port"}},"processedSecurityOptions":[{"schemes":[{"scheme":{"type":"http","scheme":"bearer","description":"The server's token (MIRAGE_AUTH_TOKEN) or a JWT. A daemon in the default local mode with no token accepts requests without one.","scopes":[],"schemeName":"bearerAuth"},"schema":{"title":"Bearer Auth","type":"string","isRequired":true,"description":"The server's token (MIRAGE_AUTH_TOKEN) or a JWT. A daemon in the default local mode with no token accepts requests without one.","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"bearerAuth","name":"Authorization"}],"title":"bearerAuth"}]},"originalFileLocation":"openapi.yaml"},"subdomain":"struktoai","siteName":"Mirage","title":"Create a workspace - Mirage","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-11-06T19:53:32.113Z","originalFileLocation":"api/operations/workspaces/create-a-workspace.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Create a workspace, or answer the live one created from this config. Creating is idempotent for one config: an id already held by a workspace created from an identical config answers that workspace with 200, so a client that names its workspace can run again and reach it; an id held by anything else is refused with 409. The server\u0026#x27;s policies judge the config as written (pre_workspace) before any of it is built: a refusal is 403 with its reason, and explain answers what they say without creating anything.\">\u003cmeta data-mint-head name=\"keywords\" content=\"Mirage, filesystem for AI agents, virtual filesystem, AI agent tools, agent infrastructure, MCP alternative, bash for agents, S3 filesystem, Google Drive filesystem, Slack filesystem, GitHub filesystem, agent sandbox, Strukto\">\u003cmeta data-mint-head name=\"application-name\" content=\"Mirage\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003cmeta data-mint-head name=\"robots\" content=\"index, follow\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Create a workspace - Mirage\">\u003cmeta data-mint-head property=\"og:description\" content=\"Create a workspace, or answer the live one created from this config. Creating is idempotent for one config: an id already held by a workspace created from an identical config answers that workspace with 200, so a client that names its workspace can run again and reach it; an id held by anything else is refused with 409. The server\u0026#x27;s policies judge the config as written (pre_workspace) before any of it is built: a refusal is 403 with its reason, and explain answers what they say without creating anything.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Mirage\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://raw.githubusercontent.com/strukto-ai/mirage/main/assets/mirage-og-light@2x.png\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Create a workspace - Mirage\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Create a workspace, or answer the live one created from this config. Creating is idempotent for one config: an id already held by a workspace created from an identical config answers that workspace with 200, so a client that names its workspace can run again and reach it; an id held by anything else is refused with 409. The server\u0026#x27;s policies judge the config as written (pre_workspace) before any of it is built: a refusal is 403 with its reason, and explain answers what they say without creating anything.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://raw.githubusercontent.com/strukto-ai/mirage/main/assets/mirage-og-light@2x.png\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/struktoai/3lv99snhL-Tr_A0L/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Mirage\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#0C0C0C\">\u003cmeta data-mint-head name=\"og:locale\" content=\"en_US\">\u003cmeta data-mint-head name=\"author\" content=\"Strukto\">\u003cmeta data-mint-head name=\"googlebot\" content=\"index, follow\">\u003cmeta data-mint-head name=\"theme-color\" content=\"#0C0C0C\">\u003cmeta data-mint-head name=\"color-scheme\" content=\"light dark\">\u003cmeta data-mint-head name=\"language\" content=\"en\">\u003cmeta data-mint-head name=\"category\" content=\"Technology\">\u003cmeta data-mint-head name=\"target\" content=\"developers\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-capable\" content=\"yes\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-status-bar-style\" content=\"black-translucent\">\u003cmeta data-mint-head name=\"og:image:alt\" content=\"Mirage: a virtual terminal for AI agents\">\u003cmeta data-mint-head name=\"twitter:creator\" content=\"@struktoai\">\u003cmeta data-mint-head name=\"twitter:image:alt\" content=\"Mirage · A Virtual Terminal for AI Agents | Strukto\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api/operations/workspaces/create-a-workspace.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.mirage.strukto.ai/#organization\",\"name\":\"Mirage\",\"url\":\"https://docs.mirage.strukto.ai\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/struktoai/7G-pGKhPIqaKqOXr/logo/light.svg?fit=max\u0026auto=format\u0026n=7G-pGKhPIqaKqOXr\u0026q=85\u0026s=d7007be7b5588a72b2072d2c33791785\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.mirage.strukto.ai#website\",\"name\":\"Mirage\",\"url\":\"https://docs.mirage.strukto.ai\",\"publisher\":{\"@id\":\"https://docs.mirage.strukto.ai/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace#webpage\",\"url\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace\",\"name\":\"Create a workspace\",\"description\":\"Create a workspace, or answer the live one created from this config. Creating is idempotent for one config: an id already held by a workspace created from an identical config answers that workspace with 200, so a client that names its workspace can run again and reach it; an id held by anything else is refused with 409. The server's policies judge the config as written (pre_workspace) before any of it is built: a refusal is 403 with its reason, and explain answers what they say without creating anything.\",\"dateModified\":\"2026-11-06T19:53:32.113Z\",\"isPartOf\":{\"@id\":\"https://docs.mirage.strukto.ai#website\"},\"breadcrumb\":{\"@id\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Operations\",\"item\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/list-workspaces\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Workspaces\",\"item\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/list-workspaces\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Create a workspace\",\"item\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace#apireference\",\"headline\":\"Create a workspace\",\"name\":\"Create a workspace\",\"description\":\"Create a workspace, or answer the live one created from this config. Creating is idempotent for one config: an id already held by a workspace created from an identical config answers that workspace with 200, so a client that names its workspace can run again and reach it; an id held by anything else is refused with 409. The server's policies judge the config as written (pre_workspace) before any of it is built: a refusal is 403 with its reason, and explain answers what they say without creating anything.\",\"url\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace\",\"mainEntityOfPage\":{\"@id\":\"https://docs.mirage.strukto.ai/api/operations/workspaces/create-a-workspace#webpage\"},\"image\":\"https://raw.githubusercontent.com/strukto-ai/mirage/main/assets/mirage-og-light@2x.png\",\"dateModified\":\"2026-11-06T19:53:32.113Z\",\"publisher\":{\"@id\":\"https://docs.mirage.strukto.ai/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.mirage.strukto.ai#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Mirage\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Mirage","nav":{"global":null,"tabs":[{"tab":"Home","icon":"https://mintlify.s3.us-west-1.amazonaws.com/struktoai/images/mirage-icon-light.svg","pages":[{"title":"Home","href":"/home/introduction"}]},{"tab":"Python","icon":"https://mintlify.s3.us-west-1.amazonaws.com/struktoai/images/python-logo.svg","pages":[{"title":"Python","href":"/python/install"}]},{"tab":"TS","icon":"https://mintlify.s3.us-west-1.amazonaws.com/struktoai/images/typescript-logo.svg","pages":[{"title":"TS","href":"/typescript/install"}]},{"tab":"API","icon":"code","groups":[{"group":"HTTP API","pages":[{"title":"Overview","icon":"book-open","href":"/api/overview"},{"title":"API reference","description":"Every route of the Mirage HTTP API, generated from openapi.yaml.","icon":"list","href":"/api/reference"}]},{"group":"Operations","hidden":true,"searchable":true,"pages":[{"group":"Workspaces","pages":[{"title":"List workspaces","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces","href":"/api/operations/workspaces/list-workspaces"},{"title":"Create a workspace","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces","href":"/api/operations/workspaces/create-a-workspace"},{"title":"Get a workspace","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}","href":"/api/operations/workspaces/get-a-workspace"},{"title":"Delete a workspace","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml delete /v1/workspaces/{workspace_id}","href":"/api/operations/workspaces/delete-a-workspace"},{"title":"Read a workspace's history","description":"The workspace's recorded history, oldest first: a `command`\nentry for every line its sessions ran, and with `vfs` a `vfs`\nentry for every call a line made to a mount. Read on the workspace's\nown loop.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}/history","href":"/api/operations/workspaces/read-a-workspaces-history"},{"title":"Close a workspace","description":"Close the workspace and keep its state for the owner to reopen.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/close","href":"/api/operations/workspaces/close-a-workspace"},{"title":"Cancel a workspace's lines","description":"Cancel every session's running and queued lines; all stay open.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/cancel","href":"/api/operations/workspaces/cancel-a-workspaces-lines"},{"title":"Kill a workspace's jobs","description":"Kill every session's background jobs and runners.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/kill","href":"/api/operations/workspaces/kill-a-workspaces-jobs"},{"title":"Set a profile","description":"Define a named profile on the live workspace, or replace it.\n\nOnly the live table changes: a session moves when it is updated\nonto the name, and the workspace's config is never rewritten.","deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/workspaces/{workspace_id}/profiles/{name}","href":"/api/operations/workspaces/set-a-profile"},{"title":"Install an MCP CLI","description":"Install an MCP server as a CLI on the live workspace.\n\nThe body is one `clis:` entry, `cli: mcp` with its config, as a\nconfig file states it. Its pointers resolve and its tools are listed\nunder the workspace's network. A name already installed answers 409.","deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/workspaces/{workspace_id}/clis/{name}","href":"/api/operations/workspaces/install-an-mcp-cli"},{"title":"Remove an MCP CLI","description":"Remove an MCP CLI from the live workspace.","deprecated":null,"version":null,"openapi":"/openapi.yaml delete /v1/workspaces/{workspace_id}/clis/{name}","href":"/api/operations/workspaces/remove-an-mcp-cli"}]},{"group":"Snapshots","pages":[{"title":"Clone a workspace","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/clone","href":"/api/operations/snapshots/clone-a-workspace"},{"title":"Download a snapshot","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}/snapshot","href":"/api/operations/snapshots/download-a-snapshot"},{"title":"Snapshot a workspace","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/snapshot","href":"/api/operations/snapshots/snapshot-a-workspace"},{"title":"Load a snapshot","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/load","href":"/api/operations/snapshots/load-a-snapshot"}]},{"group":"Templates","pages":[{"title":"List templates","description":"The saved templates, by name.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/templates","href":"/api/operations/templates/list-templates"},{"title":"Create a template","description":"Save a template: a whole workspace config, checked as a create\nchecks one, and kept as written. A name already saved is a 409.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/templates","href":"/api/operations/templates/create-a-template"},{"title":"Get a template","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/templates/{ref}","href":"/api/operations/templates/get-a-template"},{"title":"Delete a template","description":"Delete a template; `restore` brings it back.","deprecated":null,"version":null,"openapi":"/openapi.yaml delete /v1/templates/{ref}","href":"/api/operations/templates/delete-a-template"},{"title":"Restore a template","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/templates/{ref}/restore","href":"/api/operations/templates/restore-a-template"}]},{"group":"Documents","pages":[{"title":"Read the workspace's VFS.md","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}/vfs-md","href":"/api/operations/documents/read-the-workspaces-vfsmd"},{"title":"Write the workspace's VFS.md","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/workspaces/{workspace_id}/vfs-md","href":"/api/operations/documents/write-the-workspaces-vfsmd"},{"title":"Read a session's VFS.md","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}/sessions/{session_id}/vfs-md","href":"/api/operations/documents/read-a-sessions-vfsmd"},{"title":"Write a session's VFS.md","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/workspaces/{workspace_id}/sessions/{session_id}/vfs-md","href":"/api/operations/documents/write-a-sessions-vfsmd"},{"title":"Read the workspace's SKILL.md","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}/skill-md","href":"/api/operations/documents/read-the-workspaces-skillmd"},{"title":"Write the workspace's SKILL.md","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/workspaces/{workspace_id}/skill-md","href":"/api/operations/documents/write-the-workspaces-skillmd"},{"title":"Read a session's SKILL.md","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}/sessions/{session_id}/skill-md","href":"/api/operations/documents/read-a-sessions-skillmd"},{"title":"Write a session's SKILL.md","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/workspaces/{workspace_id}/sessions/{session_id}/skill-md","href":"/api/operations/documents/write-a-sessions-skillmd"}]},{"group":"Sessions","pages":[{"title":"List sessions","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}/sessions","href":"/api/operations/sessions/list-sessions"},{"title":"Create a session","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/sessions","href":"/api/operations/sessions/create-a-session"},{"title":"Delete a session","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml delete /v1/workspaces/{workspace_id}/sessions/{session_id}","href":"/api/operations/sessions/delete-a-session"},{"title":"Change a session's profile","description":"Replace the session's profile; its cwd, env and history stay.","deprecated":null,"version":null,"openapi":"/openapi.yaml patch /v1/workspaces/{workspace_id}/sessions/{session_id}","href":"/api/operations/sessions/change-a-sessions-profile"},{"title":"Cancel a session's lines","description":"Cancel the session's running and queued lines, from every entry point.\n\nThe session stays open; returns once those lines have ended.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/sessions/{session_id}/cancel","href":"/api/operations/sessions/cancel-a-sessions-lines"},{"title":"Kill a session's jobs","description":"Kill the session's background jobs and runners; it stays open.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/sessions/{session_id}/kill","href":"/api/operations/sessions/kill-a-sessions-jobs"}]},{"group":"Asks","pages":[{"title":"List asks","description":"The workspace's asks: pending by default, every decision under\n`all=true`. The ledger already serves both views from one store,\nso the entry point only picks which query to run.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/workspaces/{workspace_id}/asks","href":"/api/operations/asks/list-asks"},{"title":"Answer an ask","description":"Answer one waiting ask, allow or deny, and return the settled\nrecord. A known id with nothing waiting is 409 rather than 404, so\nan operator retrying a click reads \"already answered\", not \"not\nfound\".","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/asks/{ask_id}","href":"/api/operations/asks/answer-an-ask"}]},{"group":"Shell","pages":[{"title":"Run a shell line","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/shell","href":"/api/operations/shell/run-a-shell-line"},{"title":"Match paths","description":"`session.glob`: every path a pattern matches, as the session\nsees them.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/glob","href":"/api/operations/shell/match-paths"}]},{"group":"Tools","pages":[{"title":"Shell tool","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/tools/shell","href":"/api/operations/tools/shell-tool"},{"title":"Read tool","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/tools/read","href":"/api/operations/tools/read-tool"},{"title":"Write tool","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/tools/write","href":"/api/operations/tools/write-tool"},{"title":"Edit tool","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/tools/edit","href":"/api/operations/tools/edit-tool"},{"title":"Ls tool","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/tools/ls","href":"/api/operations/tools/ls-tool"},{"title":"Grep tool","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/tools/grep","href":"/api/operations/tools/grep-tool"},{"title":"Glob tool","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/tools/glob","href":"/api/operations/tools/glob-tool"}]},{"group":"VFS","pages":[{"title":"VFS read","description":"Read a file's bytes, from an offset.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/read","href":"/api/operations/vfs/vfs-read"},{"title":"VFS write","description":"Write a file's bytes, replacing what it held.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/write","href":"/api/operations/vfs/vfs-write"},{"title":"VFS append","description":"Append bytes to a file.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/append","href":"/api/operations/vfs/vfs-append"},{"title":"VFS pwrite","description":"Write bytes into a file at an offset.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/pwrite","href":"/api/operations/vfs/vfs-pwrite"},{"title":"VFS stat","description":"A path's metadata.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/stat","href":"/api/operations/vfs/vfs-stat"},{"title":"VFS readdir","description":"A directory's entries.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/readdir","href":"/api/operations/vfs/vfs-readdir"},{"title":"VFS exists","description":"Whether a path exists.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/exists","href":"/api/operations/vfs/vfs-exists"},{"title":"VFS is_dir","description":"Whether a path is a directory.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/is_dir","href":"/api/operations/vfs/vfs-is_dir"},{"title":"VFS is_file","description":"Whether a path is a file.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/is_file","href":"/api/operations/vfs/vfs-is_file"},{"title":"VFS list_files","description":"The names of a directory's files.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/list_files","href":"/api/operations/vfs/vfs-list_files"},{"title":"VFS mkdir","description":"Make a directory.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/mkdir","href":"/api/operations/vfs/vfs-mkdir"},{"title":"VFS rmdir","description":"Remove an empty directory.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/rmdir","href":"/api/operations/vfs/vfs-rmdir"},{"title":"VFS unlink","description":"Remove a file.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/unlink","href":"/api/operations/vfs/vfs-unlink"},{"title":"VFS create","description":"Create an empty file.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/create","href":"/api/operations/vfs/vfs-create"},{"title":"VFS rename","description":"Rename a path within its mount.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/rename","href":"/api/operations/vfs/vfs-rename"},{"title":"VFS symlink","description":"Make a symbolic link at a path.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/symlink","href":"/api/operations/vfs/vfs-symlink"},{"title":"VFS readlink","description":"Where a symbolic link points.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/readlink","href":"/api/operations/vfs/vfs-readlink"},{"title":"VFS setattr","description":"Change a path's mode, owner or times.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/setattr","href":"/api/operations/vfs/vfs-setattr"},{"title":"VFS getxattr","description":"One extended attribute's value.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/getxattr","href":"/api/operations/vfs/vfs-getxattr"},{"title":"VFS listxattr","description":"A path's extended attribute names.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/listxattr","href":"/api/operations/vfs/vfs-listxattr"},{"title":"VFS setxattr","description":"Set an extended attribute.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/setxattr","href":"/api/operations/vfs/vfs-setxattr"},{"title":"VFS removexattr","description":"Remove an extended attribute.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/removexattr","href":"/api/operations/vfs/vfs-removexattr"},{"title":"VFS truncate","description":"Cut or extend a file to a length.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/truncate","href":"/api/operations/vfs/vfs-truncate"},{"title":"Call any VFS function","description":"Call a declared VFS function using the ordinary session and policy gate.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/workspaces/{workspace_id}/vfs/{name}","href":"/api/operations/vfs/call-any-vfs-function"}]},{"group":"Server","pages":[{"title":"Check health","description":null,"deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/health","href":"/api/operations/server/check-health"},{"title":"Check readiness","description":"Whether the server takes new workspaces: 503 while it drains for\nshutdown or holds `max_workspaces`, so a load balancer sends new\nwork elsewhere. `/v1/health` only says the process is up.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/ready","href":"/api/operations/server/check-readiness"},{"title":"Shut down the server","description":"Trip the exit event, which the app's `on_idle_exit` acts on.\n\nThe daemon's hook sends SIGTERM to its own process, so uvicorn runs\nits graceful shutdown (close connections, run the lifespan's finally\nblock). An app run without a hook keeps serving. The server serves\nevery account, so an account may not stop it.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/shutdown","href":"/api/operations/server/shut-down-the-server"}]},{"group":"Auth","pages":[{"title":"Read OAuth protected-resource metadata","description":"Say where to log in, for `mirage login`.\n\nRFC 9728's protected resource metadata names the issuer, and\n`client_id` the OAuth client the CLI signs in as. A server that\npublishes no login answers 404, so the CLI knows it needs none.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /.well-known/oauth-protected-resource","href":"/api/operations/auth/read-oauth-protected-resource-metadata"}]},{"group":"Saved VFS","pages":[{"title":"List VFS configs","description":"The saved VFS configs: a mount's type and fields, kept by name for templates to use.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/vfs","href":"/api/operations/saved-vfs/list-vfs-configs"},{"title":"Create a VFS config","description":"Save a VFS config. Its fields are checked against the type's; secret fields are sealed, and a string field may point at a saved store's secret instead. A name already saved is a 409.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/vfs","href":"/api/operations/saved-vfs/create-a-vfs-config"},{"title":"List VFS config types","description":"Every type a VFS config can be, with the fields its config takes.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/vfs/types","href":"/api/operations/saved-vfs/list-vfs-config-types"},{"title":"Get a VFS config","description":"One saved VFS config, with its sealed fields named but not answered.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/vfs/{ref}","href":"/api/operations/saved-vfs/get-a-vfs-config"},{"title":"Update a VFS config","description":"Change a VFS config's fields. Its name and type stay; a sealed field left out keeps its value.","deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/vfs/{ref}","href":"/api/operations/saved-vfs/update-a-vfs-config"},{"title":"Delete a VFS config","description":"Delete a saved VFS config.","deprecated":null,"version":null,"openapi":"/openapi.yaml delete /v1/vfs/{ref}","href":"/api/operations/saved-vfs/delete-a-vfs-config"}]},{"group":"Saved CLIs","pages":[{"title":"List CLI configs","description":"The saved CLI configs: a CLI install's type and fields, kept by name for templates to use.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/clis","href":"/api/operations/saved-clis/list-cli-configs"},{"title":"Create a CLI config","description":"Save a CLI config. Its fields are checked against the type's; secret fields are sealed, and a string field may point at a saved store's secret instead. A name already saved is a 409.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/clis","href":"/api/operations/saved-clis/create-a-cli-config"},{"title":"List CLI config types","description":"Every type a CLI config can be, with the fields its config takes.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/clis/types","href":"/api/operations/saved-clis/list-cli-config-types"},{"title":"Get a CLI config","description":"One saved CLI config, with its sealed fields named but not answered.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/clis/{ref}","href":"/api/operations/saved-clis/get-a-cli-config"},{"title":"Update a CLI config","description":"Change a CLI config's fields. Its name and type stay; a sealed field left out keeps its value.","deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/clis/{ref}","href":"/api/operations/saved-clis/update-a-cli-config"},{"title":"Delete a CLI config","description":"Delete a saved CLI config.","deprecated":null,"version":null,"openapi":"/openapi.yaml delete /v1/clis/{ref}","href":"/api/operations/saved-clis/delete-a-cli-config"}]},{"group":"Saved runtimes","pages":[{"title":"List runtime configs","description":"The saved runtime configs: a runtime's type and fields, kept by name for templates to use.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/runtimes","href":"/api/operations/saved-runtimes/list-runtime-configs"},{"title":"Create a runtime config","description":"Save a runtime config. Its fields are checked against the type's; secret fields are sealed, and a string field may point at a saved store's secret instead. A name already saved is a 409.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/runtimes","href":"/api/operations/saved-runtimes/create-a-runtime-config"},{"title":"List runtime config types","description":"Every type a runtime config can be, with the fields its config takes.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/runtimes/types","href":"/api/operations/saved-runtimes/list-runtime-config-types"},{"title":"Get a runtime config","description":"One saved runtime config, with its sealed fields named but not answered.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/runtimes/{ref}","href":"/api/operations/saved-runtimes/get-a-runtime-config"},{"title":"Update a runtime config","description":"Change a runtime config's fields. Its name and type stay; a sealed field left out keeps its value.","deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/runtimes/{ref}","href":"/api/operations/saved-runtimes/update-a-runtime-config"},{"title":"Delete a runtime config","description":"Delete a saved runtime config.","deprecated":null,"version":null,"openapi":"/openapi.yaml delete /v1/runtimes/{ref}","href":"/api/operations/saved-runtimes/delete-a-runtime-config"}]},{"group":"Policies","pages":[{"title":"List policies","description":"The saved policies' names, sorted. Get one for its source.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/policies","href":"/api/operations/policies/list-policies"},{"title":"Create a policy","description":"Save a policy program, by name. A name already saved is a 409.","deprecated":null,"version":null,"openapi":"/openapi.yaml post /v1/policies","href":"/api/operations/policies/create-a-policy"},{"title":"Get a policy","description":"One saved policy, with its source.","deprecated":null,"version":null,"openapi":"/openapi.yaml get /v1/policies/{ref}","href":"/api/operations/policies/get-a-policy"},{"title":"Update a policy","description":"Replace a saved policy's source.","deprecated":null,"version":null,"openapi":"/openapi.yaml put /v1/policies/{ref}","href":"/api/operations/policies/update-a-policy"},{"title":"Delete a policy","description":"Delete a saved policy.","deprecated":null,"version":null,"openapi":"/openapi.yaml delete /v1/policies/{ref}","href":"/api/operations/policies/delete-a-policy"}]}]}]}]},"basePath":"","title":"Create a workspace - Mirage","buildId":"dpl_8LJbrAiZvr1K98WQNZXCyY5AvT34","deploymentId":"dpl_8LJbrAiZvr1K98WQNZXCyY5AvT34","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-i2a3QZ8E.js","utils-ChLwp8m0.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-DRktVTDc.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-CA2pEs4T.js","snippetPresets-ClQ6XrKD.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-Ct_Lv36y.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-Cn2PYw9e.js","shallow-rkyymjXQ.js","getApiPlaygroundDisplay-BB9vkXtE.js","CodeSnippet-Bm5RU7m1.js","CodeSnippets-BgU9Deuz.js","Page-BUDYNlhG.js","getPastedJson-BD-6NNum.js","icon-8Z6tud2e.js","MethodPill-Tuzr4g3V.js","DuplicateIcon-0ceWFYhN.js","createIcon-FBXow_ST.js","DynamicMarkdown-CD8713Yy.js","SectionHeading-7zgzQbH-.js","axios-vUo_bRtp.js","Markdown-D7Ofw1oz.js","clsx-eKJ4rcii.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-CwjSCXIK.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-9EK5IAXV.js"]}